The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.
CVSS Details
- CVSS 3.1 Base Score: 5.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Mar 23, 2021 |
| Debian | — | Upgrade qemu | Apr 12, 2021 | Mar 23, 2021 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Aug 16, 2022 | Mar 23, 2021 |
| Oracle_linux | — | Upgrade ruby-hivexUpgrade libguestfs-toolsUpgrade libvirtUpgrade libguestfs-javaUpgrade libvirt-dbusUpgrade supermin-develUpgrade perl-hivexUpgrade sgabiosUpgrade libvirt-daemon-driver-storage-rbdUpgrade netcf-develUpgrade libvirt-daemon-config-nwfilterUpgrade seabios-binUpgrade qemu-system-aarch64Upgrade libguestfs-inspect-iconsUpgrade libvirt-daemon-driver-storageUpgrade hivexUpgrade qemu-system-x86Upgrade libguestfs-javadocUpgrade nbdkit-linuxdisk-pluginUpgrade libvirt-daemon-driver-interfaceUpgrade libguestfs-xfsUpgrade sgabios-binUpgrade libvirt-daemon-driver-secretUpgrade qemu-system-aarch64-coreUpgrade qemu-kvm-block-glusterUpgrade virt-v2vUpgrade seabiosUpgrade qemu-kvm-commonUpgrade libiscsiUpgrade libvirt-daemon-driver-storage-coreUpgrade hivex-develUpgrade libiscsi-develUpgrade libguestfs-java-develUpgrade ruby-libguestfsUpgrade qemu-kvm-coreUpgrade superminUpgrade libguestfs-gfs2Upgrade libvirt-docsUpgrade nbdkit-python-pluginUpgrade libvirt-daemon-driver-nwfilterUpgrade qemu-imgUpgrade libvirt-daemon-driver-storage-logicalUpgrade qemu-kvm-block-rbdUpgrade libvirt-daemon-driver-networkUpgrade libguestfs-develUpgrade libguestfs-gobjectUpgrade libvirt-daemon-driver-storage-scsiUpgrade python3-libnbdUpgrade nbdkitUpgrade virt-dibUpgrade libvirt-nssUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-libsUpgrade netcf-libsUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storage-iscsiUpgrade nbdkit-basic-pluginsUpgrade lua-guestfsUpgrade nbdkit-ssh-pluginUpgrade seavgabios-binUpgrade qemu-kvm-block-sshUpgrade nbdkit-example-pluginsUpgrade libnbdUpgrade libvirt-bash-completionUpgrade qemu-guest-agentUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-kvmUpgrade qemu-kvm-block-curlUpgrade libvirt-lock-sanlockUpgrade libvirt-clientUpgrade nbdkit-gzip-pluginUpgrade qemu-kvm-block-iscsiUpgrade libguestfs-rescueUpgrade libguestfs-man-pages-ukUpgrade qemu-system-x86-coreUpgrade qemu-commonUpgrade python3-libguestfsUpgrade nbdkit-serverUpgrade perl-Sys-GuestfsUpgrade libvirt-daemon-driver-storage-glusterUpgrade libguestfs-tools-cUpgrade libnbd-develUpgrade ivshmem-toolsUpgrade libguestfs-benchmarkingUpgrade qemu-block-glusterUpgrade qemu-block-iscsiUpgrade libvirt-daemon-config-networkUpgrade libguestfs-gobject-develUpgrade qemu-block-rbdUpgrade libvirt-daemonUpgrade libguestfsUpgrade libguestfs-man-pages-jaUpgrade nbdkit-develUpgrade libiscsi-utilsUpgrade nbdkit-basic-filtersUpgrade nbdfuseUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-adminUpgrade libguestfs-rsyncUpgrade perl-Sys-VirtUpgrade nbdkit-xz-filterUpgrade python3-libvirtUpgrade libguestfs-winsupportUpgrade libguestfs-bash-completionUpgrade qemu-kvmUpgrade python3-hivexUpgrade netcfUpgrade nbdkit-vddk-pluginUpgrade libvirt-develUpgrade qemuUpgrade nbdkit-bash-completionUpgrade nbdkit-curl-plugin | Jun 6, 2021 | Dec 28, 2020 |
| Suse | — | Upgrade qemuUpgrade qemu-block-curlUpgrade qemu-ui-sdlUpgrade qemu-chardev-baumUpgrade qemu-ui-gtkUpgrade qemu-hw-usb-hostUpgrade qemu-s390Upgrade qemu-audio-paUpgrade qemu-hw-usb-redirectUpgrade qemu-sgabiosUpgrade qemu-vgabiosUpgrade qemu-block-nfsUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-block-dmgUpgrade qemu-toolsUpgrade qemu-x86Upgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-kvmUpgrade qemu-microvmUpgrade qemu-extraUpgrade qemu-ui-cursesUpgrade qemu-hw-usb-smartcardUpgrade qemu-slofUpgrade qemu-skibootUpgrade qemu-ui-openglUpgrade qemu-ppcUpgrade qemu-audio-ossUpgrade qemu-block-glusterUpgrade qemu-langUpgrade qemu-ui-spice-coreUpgrade qemu-block-rbdUpgrade qemu-hw-display-qxlUpgrade qemu-chardev-spiceUpgrade qemu-audio-sdlUpgrade qemu-audio-spiceUpgrade qemu-block-sshUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-guest-agentUpgrade qemu-ui-spice-appUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-accel-tcg-x86Upgrade qemu-armUpgrade qemu-ksmUpgrade qemu-block-iscsiUpgrade qemu-audio-alsaUpgrade qemu-ivshmem-toolsUpgrade qemu-vhost-user-gpuUpgrade qemu-s390xUpgrade qemu-seabiosUpgrade qemu-ipxe | Jun 11, 2021 | Mar 23, 2021 |
| Ubuntu | — | Upgrade qemu-common (Ubuntu Pro)Upgrade qemu-system-x86-microvmUpgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-utils (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-systemUpgrade qemu (Ubuntu Pro)Upgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-block-extra (Ubuntu Pro)Upgrade qemu-kvm (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-system-x86-xenUpgrade qemu-system-s390x (Ubuntu Pro)Upgrade qemu-system-x86Upgrade qemu-user-static (Ubuntu Pro)Upgrade qemu-system (Ubuntu Pro)Upgrade qemu-user-binfmt (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-system-miscUpgrade qemu-user (Ubuntu Pro)Upgrade qemu-guest-agent (Ubuntu Pro)Upgrade qemu-system-armUpgrade qemu-keymaps (Ubuntu Pro)Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-ppc | Jul 16, 2021 | Mar 23, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub