rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
CVSS Details
- CVSS 3.1 Base Score: 5.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Jun 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade qemu-audio-ossUpgrade qemu-imgUpgrade qemu-user-binfmtUpgrade qemu-user-staticUpgrade qemu-ui-sdlUpgrade qemu-audio-sdlUpgrade qemu-block-dmgUpgrade qemu-kvm-coreUpgrade qemu-system-aarch64Upgrade qemu-ui-cursesUpgrade qemu-block-nfsUpgrade qemu-system-x86Upgrade qemu-debuginfoUpgrade qemu-kvmUpgrade qemu-audio-paUpgrade qemu-block-curlUpgrade qemu-commonUpgrade qemu-system-aarch64-coreUpgrade qemu-system-x86-coreUpgrade qemuUpgrade qemu-audio-alsaUpgrade qemu-ui-gtkUpgrade qemu-userUpgrade qemu-block-rbdUpgrade ivshmem-toolsUpgrade qemu-guest-agentUpgrade qemu-block-sshUpgrade qemu-block-iscsi | Mar 22, 2021 | Jun 4, 2020 |
| Amazon_linux | — | Upgrade qemu-kvm | Mar 20, 2021 | Jun 4, 2020 |
| Centos_linux | — | Upgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm-toolsUpgrade qemu-kvm-debuginfoUpgrade qemu-kvm | Feb 4, 2021 | Jun 4, 2020 |
| Debian | — | Upgrade qemu | Jul 2, 2020 | Jun 4, 2020 |
| Oracle_linux | — | Upgrade qemu-kvm-toolsUpgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm | Feb 4, 2021 | May 12, 2020 |
| Redhat_linux | — | Upgrade qemu-kvm-toolsNo solution existsUpgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm-debuginfo | Feb 4, 2021 | Jun 4, 2020 |
| Suse | — | Upgrade qemu-vgabiosUpgrade qemu-audio-paUpgrade qemu-ui-cursesUpgrade qemu-s390Upgrade qemu-audio-alsaUpgrade qemu-ui-gtkUpgrade qemu-ppcUpgrade qemu-sgabiosUpgrade qemu-x86Upgrade qemu-block-curlUpgrade qemu-kvmUpgrade kvmUpgrade qemu-ipxeUpgrade qemu-ui-sdlUpgrade qemu-block-sshUpgrade qemu-seabiosUpgrade qemu-guest-agentUpgrade qemu-audio-sdlUpgrade qemu-block-iscsiUpgrade qemu-audio-ossUpgrade qemu-toolsUpgrade qemu-langUpgrade qemu-block-rbdUpgrade qemuUpgrade qemu-arm | Apr 17, 2021 | Jun 4, 2020 |
| Ubuntu | — | Upgrade qemu (Ubuntu Pro)Upgrade qemu-system-ppcUpgrade qemu-system (Ubuntu Pro)Upgrade qemuUpgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-systemUpgrade qemu-system-armUpgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-system-mipsUpgrade qemu-system-aarch64Upgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-x86 | Aug 20, 2020 | Jun 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub