sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Sep 15, 2020 | May 27, 2020 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Nov 12, 2020 | May 27, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-img | Nov 3, 2020 | May 27, 2020 |
| Oracle_linux | — | Upgrade qemu-kvm-coreUpgrade qemu-imgUpgrade qemu-system-x86Upgrade qemu-system-aarch64Upgrade qemu-system-aarch64-coreUpgrade qemuUpgrade qemu-block-rbdUpgrade qemu-commonUpgrade qemu-block-glusterUpgrade ivshmem-toolsUpgrade qemu-kvmUpgrade qemu-system-x86-coreUpgrade qemu-block-iscsi | Feb 9, 2021 | May 20, 2020 |
| Suse | — | Upgrade qemu-s390 | Jan 28, 2022 | May 27, 2020 |
| Ubuntu | — | Upgrade qemu-systemUpgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-system-mipsUpgrade qemu-system-x86Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-aarch64Upgrade qemu-system-x86-xenUpgrade qemu-system-x86-microvmUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-armUpgrade qemuUpgrade qemu-system-ppcUpgrade qemu-system-sparc | Aug 20, 2020 | May 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub