rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
CVSS Details
- CVSS 3.1 Base Score: 5.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Jun 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade qemu-block-nfsUpgrade qemu-block-dmgUpgrade qemu-audio-sdlUpgrade qemu-imgUpgrade qemu-system-aarch64Upgrade qemu-ui-sdlUpgrade qemu-user-binfmtUpgrade qemu-ui-cursesUpgrade qemu-user-staticUpgrade qemu-kvm-coreUpgrade qemu-audio-ossUpgrade qemu-system-x86Upgrade qemu-debuginfoUpgrade qemu-block-curlUpgrade qemuUpgrade qemu-kvmUpgrade qemu-audio-paUpgrade qemu-system-aarch64-coreUpgrade qemu-userUpgrade qemu-block-rbdUpgrade qemu-audio-alsaUpgrade qemu-system-x86-coreUpgrade qemu-ui-gtkUpgrade qemu-guest-agentUpgrade ivshmem-toolsUpgrade qemu-block-sshUpgrade qemu-block-iscsiUpgrade qemu-common | Mar 22, 2021 | Jun 4, 2020 |
| Amazon_linux | — | Upgrade qemu-kvm | Mar 20, 2021 | Jun 4, 2020 |
| Centos_linux | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm-debuginfoUpgrade qemu-kvm-tools | Feb 4, 2021 | Jun 4, 2020 |
| Debian | — | Upgrade qemu | Jul 2, 2020 | Jun 4, 2020 |
| Oracle_linux | — | Upgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-kvm-tools | Feb 4, 2021 | May 12, 2020 |
| Redhat_linux | — | Upgrade qemu-kvmUpgrade qemu-kvm-toolsNo solution existsUpgrade qemu-imgUpgrade qemu-kvm-debuginfoUpgrade qemu-kvm-common | Feb 4, 2021 | Jun 4, 2020 |
| Suse | — | Upgrade qemu-seabiosUpgrade qemu-block-sshUpgrade qemu-audio-ossUpgrade qemu-ui-sdlUpgrade qemu-guest-agentUpgrade qemu-block-rbdUpgrade qemu-toolsUpgrade qemu-armUpgrade qemu-langUpgrade qemu-block-iscsiUpgrade qemuUpgrade qemu-ipxeUpgrade qemu-audio-sdlUpgrade qemu-block-curlUpgrade qemu-ppcUpgrade qemu-kvmUpgrade qemu-audio-alsaUpgrade kvmUpgrade qemu-ui-cursesUpgrade qemu-ui-gtkUpgrade qemu-x86Upgrade qemu-vgabiosUpgrade qemu-audio-paUpgrade qemu-sgabiosUpgrade qemu-s390 | Apr 17, 2021 | Jun 4, 2020 |
| Ubuntu | — | Upgrade qemu-system-mipsUpgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-x86Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-aarch64Upgrade qemu-system-s390xUpgrade qemu-systemUpgrade qemu-system-ppcUpgrade qemu (Ubuntu Pro)Upgrade qemu-system-armUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu | Aug 20, 2020 | Jun 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub