In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.
CVSS Details
- CVSS 3.1 Base Score: 3.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | May 28, 2020 |
| Debian | — | Upgrade qemu | Jul 2, 2020 | May 28, 2020 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Nov 12, 2020 | May 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-img | Nov 3, 2020 | May 28, 2020 |
| Oracle_linux | — | Upgrade qemu-system-x86-coreUpgrade qemu-kvmUpgrade qemu-block-rbdUpgrade ivshmem-toolsUpgrade qemu-block-iscsiUpgrade qemu-system-aarch64-coreUpgrade qemu-system-x86Upgrade qemu-system-aarch64Upgrade qemu-commonUpgrade qemu-imgUpgrade qemu-kvm-coreUpgrade qemu-block-glusterUpgrade qemu | Feb 9, 2021 | May 7, 2020 |
| Suse | — | Upgrade qemuUpgrade qemu-ui-sdlUpgrade qemu-sgabiosUpgrade qemu-ui-cursesUpgrade qemu-vgabiosUpgrade qemu-block-nfsUpgrade kvmUpgrade qemu-extraUpgrade qemu-linux-userUpgrade qemu-audio-ossUpgrade qemu-microvmUpgrade qemu-vhost-user-gpuUpgrade qemu-hw-display-qxlUpgrade qemu-block-dmgUpgrade qemu-audio-sdlUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-kvmUpgrade qemu-x86Upgrade qemu-s390xUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-chardev-baumUpgrade qemu-guest-agentUpgrade qemu-ui-spice-appUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-ksmUpgrade qemu-ppcUpgrade qemu-block-glusterUpgrade qemu-audio-spiceUpgrade qemu-toolsUpgrade qemu-ui-openglUpgrade qemu-seabiosUpgrade qemu-s390Upgrade qemu-ui-gtkUpgrade qemu-skibootUpgrade qemu-block-rbdUpgrade qemu-langUpgrade qemu-chardev-spiceUpgrade qemu-ipxeUpgrade qemu-block-curlUpgrade qemu-block-sshUpgrade qemu-testsuiteUpgrade qemu-block-iscsiUpgrade qemu-audio-alsaUpgrade qemu-audio-paUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-usb-redirectUpgrade qemu-armUpgrade qemu-ui-spice-core | Jul 29, 2020 | May 28, 2020 |
| Ubuntu | — | Upgrade qemu (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-ppcUpgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-x86-xenUpgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-x86-microvmUpgrade qemuUpgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-x86Upgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-system-armUpgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-aarch64 | Aug 20, 2020 | May 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub