rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
CVSS Details
- CVSS 3.1 Base Score: 5.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Jun 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade qemu-user-binfmtUpgrade qemu-imgUpgrade qemu-block-nfsUpgrade qemu-system-aarch64Upgrade qemu-debuginfoUpgrade qemu-system-x86Upgrade qemu-ui-cursesUpgrade qemu-kvm-coreUpgrade qemu-ui-sdlUpgrade qemu-audio-ossUpgrade qemu-audio-sdlUpgrade qemu-block-dmgUpgrade qemu-user-staticUpgrade qemu-userUpgrade qemu-block-rbdUpgrade qemu-audio-alsaUpgrade qemuUpgrade qemu-guest-agentUpgrade qemu-commonUpgrade qemu-block-curlUpgrade qemu-audio-paUpgrade qemu-system-x86-coreUpgrade qemu-block-sshUpgrade qemu-block-iscsiUpgrade qemu-system-aarch64-coreUpgrade qemu-kvmUpgrade ivshmem-toolsUpgrade qemu-ui-gtk | Mar 22, 2021 | Jun 4, 2020 |
| Amazon_linux | — | Upgrade qemu-kvm | Mar 20, 2021 | Jun 4, 2020 |
| Centos_linux | — | Upgrade qemu-kvm-debuginfoUpgrade qemu-kvm-toolsUpgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm | Feb 4, 2021 | Jun 4, 2020 |
| Debian | — | Upgrade qemu | Jul 2, 2020 | Jun 4, 2020 |
| Oracle_linux | — | Upgrade qemu-kvm-toolsUpgrade qemu-kvm-commonUpgrade qemu-kvmUpgrade qemu-img | Feb 4, 2021 | May 12, 2020 |
| Redhat_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-kvm-debuginfoUpgrade qemu-imgNo solution existsUpgrade qemu-kvmUpgrade qemu-kvm-tools | Feb 4, 2021 | Jun 4, 2020 |
| Suse | — | Upgrade qemu-block-rbdUpgrade qemu-armUpgrade qemu-ipxeUpgrade qemu-audio-ossUpgrade qemu-ui-sdlUpgrade qemu-toolsUpgrade qemu-block-iscsiUpgrade qemu-langUpgrade qemu-guest-agentUpgrade qemuUpgrade qemu-seabiosUpgrade qemu-block-sshUpgrade qemu-audio-sdlUpgrade qemu-x86Upgrade qemu-ui-cursesUpgrade qemu-s390Upgrade qemu-ppcUpgrade kvmUpgrade qemu-sgabiosUpgrade qemu-block-curlUpgrade qemu-audio-paUpgrade qemu-ui-gtkUpgrade qemu-audio-alsaUpgrade qemu-kvmUpgrade qemu-vgabios | Apr 17, 2021 | Jun 4, 2020 |
| Ubuntu | — | Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-system-ppcUpgrade qemu-system-arm (Ubuntu Pro)Upgrade qemuUpgrade qemu-systemUpgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-armUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu (Ubuntu Pro)Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-aarch64Upgrade qemu-system-x86Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro) | Aug 20, 2020 | Jun 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub