rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
CVSS Details
- CVSS 3.1 Base Score: 5.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Jun 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade qemu-audio-sdlUpgrade qemu-block-dmgUpgrade qemu-user-staticUpgrade qemu-audio-ossUpgrade qemu-ui-sdlUpgrade qemu-block-nfsUpgrade qemu-user-binfmtUpgrade qemu-system-aarch64Upgrade qemu-ui-cursesUpgrade qemu-imgUpgrade qemu-debuginfoUpgrade qemu-system-x86Upgrade qemu-kvm-coreUpgrade qemu-audio-paUpgrade qemu-block-iscsiUpgrade qemu-system-aarch64-coreUpgrade qemu-block-sshUpgrade qemu-kvmUpgrade qemu-system-x86-coreUpgrade qemu-block-curlUpgrade qemu-ui-gtkUpgrade ivshmem-toolsUpgrade qemu-commonUpgrade qemu-block-rbdUpgrade qemu-userUpgrade qemu-audio-alsaUpgrade qemuUpgrade qemu-guest-agent | Mar 22, 2021 | Jun 4, 2020 |
| Amazon_linux | — | Upgrade qemu-kvm | Mar 20, 2021 | Jun 4, 2020 |
| Centos_linux | — | Upgrade qemu-kvm-toolsUpgrade qemu-kvm-debuginfoUpgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm | Feb 4, 2021 | Jun 4, 2020 |
| Debian | — | Upgrade qemu | Jul 2, 2020 | Jun 4, 2020 |
| Oracle_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-kvm-toolsUpgrade qemu-kvmUpgrade qemu-img | Feb 4, 2021 | May 12, 2020 |
| Redhat_linux | — | Upgrade qemu-kvm-debuginfoUpgrade qemu-imgUpgrade qemu-kvm-commonNo solution existsUpgrade qemu-kvmUpgrade qemu-kvm-tools | Feb 4, 2021 | Jun 4, 2020 |
| Suse | — | Upgrade qemu-x86Upgrade qemu-ui-gtkUpgrade qemu-ppcUpgrade kvmUpgrade qemu-s390Upgrade qemu-audio-paUpgrade qemu-ui-cursesUpgrade qemu-kvmUpgrade qemu-audio-alsaUpgrade qemu-block-curlUpgrade qemu-vgabiosUpgrade qemu-sgabiosUpgrade qemu-langUpgrade qemu-audio-ossUpgrade qemu-ui-sdlUpgrade qemu-toolsUpgrade qemu-block-iscsiUpgrade qemu-ipxeUpgrade qemu-audio-sdlUpgrade qemuUpgrade qemu-guest-agentUpgrade qemu-block-rbdUpgrade qemu-seabiosUpgrade qemu-armUpgrade qemu-block-ssh | Apr 17, 2021 | Jun 4, 2020 |
| Ubuntu | — | Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-system-aarch64Upgrade qemu-system-x86Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu (Ubuntu Pro)Upgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemuUpgrade qemu-system-s390xUpgrade qemu-system-ppcUpgrade qemu-systemUpgrade qemu-system-arm | Aug 20, 2020 | Jun 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub