rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
CVSS Details
- CVSS 3.1 Base Score: 5.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Jun 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade qemu-audio-ossUpgrade qemu-kvm-coreUpgrade qemu-debuginfoUpgrade qemu-system-x86Upgrade qemu-ui-cursesUpgrade qemu-ui-sdlUpgrade qemu-audio-sdlUpgrade qemu-user-binfmtUpgrade qemu-system-aarch64Upgrade qemu-user-staticUpgrade qemu-imgUpgrade qemu-block-dmgUpgrade qemu-block-nfsUpgrade qemu-kvmUpgrade qemu-guest-agentUpgrade qemu-block-rbdUpgrade qemu-userUpgrade qemuUpgrade qemu-block-iscsiUpgrade qemu-commonUpgrade qemu-ui-gtkUpgrade ivshmem-toolsUpgrade qemu-system-aarch64-coreUpgrade qemu-audio-paUpgrade qemu-block-curlUpgrade qemu-system-x86-coreUpgrade qemu-block-sshUpgrade qemu-audio-alsa | Mar 22, 2021 | Jun 4, 2020 |
| Amazon_linux | — | Upgrade qemu-kvm | Mar 20, 2021 | Jun 4, 2020 |
| Centos_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm-debuginfoUpgrade qemu-kvm-toolsUpgrade qemu-kvm | Feb 4, 2021 | Jun 4, 2020 |
| Debian | — | Upgrade qemu | Jul 2, 2020 | Jun 4, 2020 |
| Oracle_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-kvm-toolsUpgrade qemu-imgUpgrade qemu-kvm | Feb 4, 2021 | May 12, 2020 |
| Redhat_linux | — | No solution existsUpgrade qemu-kvmUpgrade qemu-kvm-toolsUpgrade qemu-kvm-commonUpgrade qemu-kvm-debuginfoUpgrade qemu-img | Feb 4, 2021 | Jun 4, 2020 |
| Suse | — | Upgrade qemu-audio-paUpgrade qemu-kvmUpgrade qemu-ui-cursesUpgrade qemu-s390Upgrade qemu-audio-alsaUpgrade qemu-x86Upgrade qemu-ui-gtkUpgrade kvmUpgrade qemu-ppcUpgrade qemu-sgabiosUpgrade qemu-vgabiosUpgrade qemu-block-curlUpgrade qemu-seabiosUpgrade qemu-ui-sdlUpgrade qemu-audio-sdlUpgrade qemuUpgrade qemu-armUpgrade qemu-block-rbdUpgrade qemu-block-sshUpgrade qemu-guest-agentUpgrade qemu-ipxeUpgrade qemu-block-iscsiUpgrade qemu-langUpgrade qemu-audio-ossUpgrade qemu-tools | Apr 17, 2021 | Jun 4, 2020 |
| Ubuntu | — | Upgrade qemu-system-aarch64Upgrade qemu-system-x86Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-system-s390xUpgrade qemu (Ubuntu Pro)Upgrade qemu-system-armUpgrade qemu-system-ppcUpgrade qemuUpgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system | Aug 20, 2020 | Jun 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub