In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
CVSS Details
- CVSS 3.1 Base Score: 3.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | May 28, 2020 |
| Debian | — | Upgrade qemu | Jul 2, 2020 | May 28, 2020 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Nov 12, 2020 | May 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-img | Nov 3, 2020 | May 28, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 28, 2020 |
| Suse | — | Upgrade qemu-ui-gtkUpgrade qemu-block-curlUpgrade qemu-chardev-baumUpgrade qemu-block-rbdUpgrade qemu-testsuiteUpgrade qemu-ksmUpgrade qemu-extraUpgrade qemu-microvmUpgrade qemu-langUpgrade qemu-s390Upgrade qemu-ui-spice-coreUpgrade qemu-kvmUpgrade qemu-audio-alsaUpgrade qemu-seabiosUpgrade qemu-vgabiosUpgrade qemu-block-iscsiUpgrade qemu-hw-usb-redirectUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-block-dmgUpgrade qemu-audio-sdlUpgrade qemu-x86Upgrade qemu-audio-spiceUpgrade qemu-s390xUpgrade qemu-vhost-user-gpuUpgrade qemu-linux-userUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-block-nfsUpgrade qemu-ipxeUpgrade qemu-ui-cursesUpgrade qemu-block-sshUpgrade kvmUpgrade qemu-toolsUpgrade qemu-skibootUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-guest-agentUpgrade qemu-hw-display-qxlUpgrade qemu-ppcUpgrade qemu-sgabiosUpgrade qemu-audio-paUpgrade qemu-armUpgrade qemu-ui-spice-appUpgrade qemu-ui-openglUpgrade qemuUpgrade qemu-ui-sdlUpgrade qemu-block-glusterUpgrade qemu-audio-ossUpgrade qemu-chardev-spice | Jul 29, 2020 | May 28, 2020 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-s390xUpgrade qemu-system-x86-microvmUpgrade qemu-system-x86-xenUpgrade qemu (Ubuntu Pro)Upgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-x86Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-ppcUpgrade qemu-systemUpgrade qemu-system-aarch64Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu | Aug 20, 2020 | May 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub