In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
CVSS Details
- CVSS 3.1 Base Score: 3.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | May 28, 2020 |
| Debian | — | Upgrade qemu | Jul 2, 2020 | May 28, 2020 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Nov 12, 2020 | May 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-img | Nov 3, 2020 | May 28, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 28, 2020 |
| Suse | — | Upgrade qemu-seabiosUpgrade qemu-audio-alsaUpgrade qemu-ui-spice-coreUpgrade qemu-hw-usb-redirectUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-x86Upgrade qemu-kvmUpgrade qemu-audio-sdlUpgrade qemu-block-curlUpgrade qemu-ksmUpgrade qemu-chardev-baumUpgrade qemu-ui-gtkUpgrade qemu-block-iscsiUpgrade qemu-s390Upgrade qemu-langUpgrade qemu-microvmUpgrade qemu-s390xUpgrade qemu-audio-spiceUpgrade qemu-extraUpgrade qemu-vgabiosUpgrade qemu-testsuiteUpgrade qemu-block-rbdUpgrade qemu-block-dmgUpgrade qemu-vhost-user-gpuUpgrade qemu-block-sshUpgrade qemu-audio-paUpgrade qemu-armUpgrade qemu-block-nfsUpgrade qemu-ui-cursesUpgrade qemu-block-glusterUpgrade qemu-ui-sdlUpgrade qemu-audio-ossUpgrade qemu-chardev-spiceUpgrade qemu-skibootUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-ui-spice-appUpgrade qemu-ppcUpgrade kvmUpgrade qemu-guest-agentUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-toolsUpgrade qemu-ui-openglUpgrade qemuUpgrade qemu-ipxeUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-hw-display-qxlUpgrade qemu-sgabiosUpgrade qemu-linux-user | Jul 29, 2020 | May 28, 2020 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-s390xUpgrade qemu (Ubuntu Pro)Upgrade qemu-system-x86-xenUpgrade qemu-system-x86-microvmUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-x86Upgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemuUpgrade qemu-system-sparcUpgrade qemu-system-aarch64Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-ppcUpgrade qemu-system-aarch64 (Ubuntu Pro) | Aug 20, 2020 | May 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub