rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
CVSS Details
- CVSS 3.1 Base Score: 5.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Jun 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade qemu-imgUpgrade qemu-audio-ossUpgrade qemu-user-staticUpgrade qemu-ui-sdlUpgrade qemu-audio-sdlUpgrade qemu-ui-cursesUpgrade qemu-block-dmgUpgrade qemu-kvm-coreUpgrade qemu-system-aarch64Upgrade qemu-debuginfoUpgrade qemu-user-binfmtUpgrade qemu-block-nfsUpgrade qemu-system-x86Upgrade qemu-audio-paUpgrade qemu-audio-alsaUpgrade qemu-system-aarch64-coreUpgrade qemu-ui-gtkUpgrade qemu-guest-agentUpgrade qemu-kvmUpgrade qemu-block-sshUpgrade qemu-block-iscsiUpgrade qemu-system-x86-coreUpgrade ivshmem-toolsUpgrade qemu-userUpgrade qemu-block-curlUpgrade qemu-block-rbdUpgrade qemuUpgrade qemu-common | Mar 22, 2021 | Jun 4, 2020 |
| Amazon_linux | — | Upgrade qemu-kvm | Mar 20, 2021 | Jun 4, 2020 |
| Centos_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-kvm-toolsUpgrade qemu-imgUpgrade qemu-kvm-debuginfoUpgrade qemu-kvm | Feb 4, 2021 | Jun 4, 2020 |
| Debian | — | Upgrade qemu | Jul 2, 2020 | Jun 4, 2020 |
| Oracle_linux | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm-tools | Feb 4, 2021 | May 12, 2020 |
| Redhat_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-kvm-debuginfoUpgrade qemu-imgNo solution existsUpgrade qemu-kvm-toolsUpgrade qemu-kvm | Feb 4, 2021 | Jun 4, 2020 |
| Suse | — | Upgrade qemuUpgrade qemu-ipxeUpgrade qemu-audio-sdlUpgrade qemu-langUpgrade qemu-audio-ossUpgrade qemu-block-iscsiUpgrade qemu-guest-agentUpgrade qemu-block-rbdUpgrade qemu-armUpgrade qemu-toolsUpgrade qemu-ui-sdlUpgrade qemu-seabiosUpgrade qemu-block-sshUpgrade qemu-ui-cursesUpgrade qemu-kvmUpgrade qemu-audio-paUpgrade qemu-ui-gtkUpgrade qemu-s390Upgrade qemu-sgabiosUpgrade qemu-vgabiosUpgrade qemu-block-curlUpgrade qemu-ppcUpgrade kvmUpgrade qemu-audio-alsaUpgrade qemu-x86 | Apr 17, 2021 | Jun 4, 2020 |
| Ubuntu | — | Upgrade qemu-system-mipsUpgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-aarch64Upgrade qemu-system-x86Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-ppcUpgrade qemu-systemUpgrade qemu-system-armUpgrade qemuUpgrade qemu (Ubuntu Pro) | Aug 20, 2020 | Jun 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub