In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
CVSS Details
- CVSS 3.1 Base Score: 3.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | May 28, 2020 |
| Debian | — | Upgrade qemu | Jul 2, 2020 | May 28, 2020 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Nov 12, 2020 | May 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-img | Nov 3, 2020 | May 28, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 28, 2020 |
| Suse | — | Upgrade qemu-ui-sdlUpgrade kvmUpgrade qemu-block-sshUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-hw-display-qxlUpgrade qemu-audio-paUpgrade qemu-block-nfsUpgrade qemu-block-glusterUpgrade qemu-ipxeUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-skibootUpgrade qemu-armUpgrade qemu-ppcUpgrade qemu-chardev-spiceUpgrade qemu-ui-spice-appUpgrade qemu-linux-userUpgrade qemu-toolsUpgrade qemu-guest-agentUpgrade qemu-audio-ossUpgrade qemu-sgabiosUpgrade qemu-ui-openglUpgrade qemuUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-ui-cursesUpgrade qemu-langUpgrade qemu-seabiosUpgrade qemu-audio-alsaUpgrade qemu-hw-usb-redirectUpgrade qemu-testsuiteUpgrade qemu-microvmUpgrade qemu-kvmUpgrade qemu-block-dmgUpgrade qemu-audio-sdlUpgrade qemu-s390xUpgrade qemu-x86Upgrade qemu-vhost-user-gpuUpgrade qemu-vgabiosUpgrade qemu-extraUpgrade qemu-audio-spiceUpgrade qemu-s390Upgrade qemu-block-iscsiUpgrade qemu-block-rbdUpgrade qemu-block-curlUpgrade qemu-chardev-baumUpgrade qemu-ui-gtkUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-ksmUpgrade qemu-ui-spice-core | Jul 29, 2020 | May 28, 2020 |
| Ubuntu | — | Upgrade qemu-system-sparcUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-systemUpgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-system-ppcUpgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-x86Upgrade qemuUpgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-aarch64Upgrade qemu-system-s390xUpgrade qemu (Ubuntu Pro)Upgrade qemu-system-armUpgrade qemu-system-x86-microvmUpgrade qemu-system-x86-xen | Aug 20, 2020 | May 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub