The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.
CVSS Details
- CVSS 3.1 Base Score: 5.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Mar 23, 2021 |
| Debian | — | Upgrade qemu | Apr 12, 2021 | Mar 23, 2021 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Aug 16, 2022 | Mar 23, 2021 |
| Oracle_linux | — | Upgrade libvirt-daemon-driver-nodedevUpgrade ivshmem-toolsUpgrade nbdkit-example-pluginsUpgrade libguestfs-benchmarkingUpgrade libvirt-daemon-driver-storage-mpathUpgrade nbdfuseUpgrade nbdkit-basic-filtersUpgrade libguestfs-tools-cUpgrade nbdkit-xz-filterUpgrade perl-Sys-VirtUpgrade libguestfs-rsyncUpgrade libnbdUpgrade nbdkit-serverUpgrade qemu-kvm-block-sshUpgrade libvirt-adminUpgrade libnbd-develUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade qemuUpgrade libvirt-lock-sanlockUpgrade libguestfs-winsupportUpgrade libguestfs-bash-completionUpgrade libguestfs-rescueUpgrade qemu-block-iscsiUpgrade netcfUpgrade python3-hivexUpgrade nbdkit-vddk-pluginUpgrade python3-libvirtUpgrade libvirt-develUpgrade qemu-kvmUpgrade libguestfs-man-pages-ukUpgrade nbdkit-develUpgrade python3-libguestfsUpgrade qemu-commonUpgrade qemu-system-x86-coreUpgrade nbdkit-gzip-pluginUpgrade qemu-kvm-block-curlUpgrade libvirt-daemon-config-networkUpgrade libguestfs-gobject-develUpgrade libvirt-bash-completionUpgrade nbdkit-curl-pluginUpgrade libvirt-clientUpgrade nbdkit-bash-completionUpgrade qemu-guest-agentUpgrade qemu-kvm-block-iscsiUpgrade libguestfs-man-pages-jaUpgrade libiscsi-utilsUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-storage-glusterUpgrade perl-Sys-GuestfsUpgrade libguestfsUpgrade qemu-block-glusterUpgrade qemu-block-rbdUpgrade libvirt-daemon-driver-secretUpgrade qemu-kvm-coreUpgrade libvirt-daemon-driver-networkUpgrade seavgabios-binUpgrade libvirt-daemon-driver-interfaceUpgrade hivexUpgrade seabios-binUpgrade netcf-develUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storageUpgrade sgabios-binUpgrade qemu-system-aarch64-coreUpgrade qemu-kvm-commonUpgrade libguestfs-inspect-iconsUpgrade hivex-develUpgrade libvirt-daemon-config-nwfilterUpgrade libguestfs-javadocUpgrade virt-v2vUpgrade libguestfs-gfs2Upgrade seabiosUpgrade libvirt-libsUpgrade libvirt-daemon-driver-qemuUpgrade libguestfs-gobjectUpgrade libvirt-daemon-driver-storage-scsiUpgrade qemu-system-x86Upgrade nbdkit-basic-pluginsUpgrade qemu-imgUpgrade virt-dibUpgrade ruby-libguestfsUpgrade libvirt-nssUpgrade libvirt-daemon-driver-storage-logicalUpgrade libguestfs-develUpgrade qemu-system-aarch64Upgrade qemu-kvm-block-glusterUpgrade python3-libnbdUpgrade libvirt-daemon-driver-storage-coreUpgrade libiscsi-develUpgrade libiscsiUpgrade libguestfs-java-develUpgrade libvirtUpgrade sgabiosUpgrade ruby-hivexUpgrade perl-hivexUpgrade nbdkit-linuxdisk-pluginUpgrade libvirt-dbusUpgrade libguestfs-toolsUpgrade libguestfs-javaUpgrade supermin-develUpgrade nbdkitUpgrade qemu-kvm-block-rbdUpgrade nbdkit-python-pluginUpgrade libvirt-docsUpgrade libvirt-daemon-driver-nwfilterUpgrade lua-guestfsUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libguestfs-xfsUpgrade netcf-libsUpgrade nbdkit-ssh-pluginUpgrade libvirt-daemon-driver-storage-diskUpgrade supermin | Jun 6, 2021 | Dec 28, 2020 |
| Suse | — | Upgrade qemu-kvmUpgrade qemu-block-nfsUpgrade qemu-vgabiosUpgrade qemu-hw-usb-redirectUpgrade qemu-x86Upgrade qemu-extraUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-ui-gtkUpgrade qemu-ui-sdlUpgrade qemu-hw-usb-hostUpgrade qemu-audio-paUpgrade qemu-microvmUpgrade qemu-ui-cursesUpgrade qemu-sgabiosUpgrade qemu-toolsUpgrade qemu-hw-usb-smartcardUpgrade qemuUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-block-dmgUpgrade qemu-block-curlUpgrade qemu-chardev-baumUpgrade qemu-s390Upgrade qemu-langUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-slofUpgrade qemu-block-iscsiUpgrade qemu-ui-spice-appUpgrade qemu-guest-agentUpgrade qemu-accel-tcg-x86Upgrade qemu-block-sshUpgrade qemu-chardev-spiceUpgrade qemu-ksmUpgrade qemu-ipxeUpgrade qemu-skibootUpgrade qemu-audio-spiceUpgrade qemu-block-glusterUpgrade qemu-hw-display-qxlUpgrade qemu-vhost-user-gpuUpgrade qemu-seabiosUpgrade qemu-s390xUpgrade qemu-ui-openglUpgrade qemu-ivshmem-toolsUpgrade qemu-ppcUpgrade qemu-audio-ossUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-ui-spice-coreUpgrade qemu-block-rbdUpgrade qemu-audio-alsaUpgrade qemu-audio-sdlUpgrade qemu-arm | Jun 11, 2021 | Mar 23, 2021 |
| Ubuntu | — | Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-keymaps (Ubuntu Pro)Upgrade qemu-system-miscUpgrade qemu-system (Ubuntu Pro)Upgrade qemu-guest-agent (Ubuntu Pro)Upgrade qemu-system-ppcUpgrade qemu-system-armUpgrade qemu-system-x86Upgrade qemu-user-static (Ubuntu Pro)Upgrade qemu-user-binfmt (Ubuntu Pro)Upgrade qemu-user (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-block-extra (Ubuntu Pro)Upgrade qemu-system-x86-microvmUpgrade qemu-system-mipsUpgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-common (Ubuntu Pro)Upgrade qemu-system-x86-xenUpgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-systemUpgrade qemu-system-s390x (Ubuntu Pro)Upgrade qemu (Ubuntu Pro)Upgrade qemu-utils (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-kvm (Ubuntu Pro)Upgrade qemu-system-ppc (Ubuntu Pro) | Jul 16, 2021 | Mar 23, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub