CVSS: 6.7EPSS: 0%CPEs: 6EXPL: 0CVE-2020-13754 – QEMU: msix: OOB access during mmio operations may lead to DoS
https://notcve.org/view.php?id=CVE-2020-13754
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. En el archivo hw/pci/msix.c en QEMU versión 4.2.0, permite a usuarios invitados del SO desencadenar un acceso fuera de límites por medio de una dirección diseñada en una operación msi-x mmio. An out-of-bounds access flaw was found in the Message Signalled Interrupt (MSI-X) device support of QEMU. This issue occurs while performing MSI-X mmio operations when a guest sent address goes beyond the mmio region. A guest user or process may use this flaw to crash the QEMU process resulting in a denial of service. • http://www.openwall.com/lists/oss-security/2020/06/01/6 http://www.openwall.com/lists/oss-security/2020/06/15/8 https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00004.html https://security.gentoo.org/glsa/202011-09 https://security.netapp.com/advisory/ntap-20200608-0007 https://usn.ubuntu.com/4467-1 https://www.debian.org/security/2020/dsa-4728 https://access.redhat.com/security/cve&#x • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 3.2EPSS: 0%CPEs: 8EXPL: 0CVE-2020-13362
https://notcve.org/view.php?id=CVE-2020-13362
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user. En QEMU versión 5.0.0 y versiones anteriores, la función megasas_lookup_frame en el archivo hw/scsi/megasas.c presenta una lectura fuera de límites mediante el campo reply_queue_head desde un usuario invitado del Sistema Operativo. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html http://www.openwall.com/lists/oss-security/2020/05/28/2 https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03131.html https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06250.html https://security-tracker.debian.org/tracker/CVE-2020-13362 https://security • CWE-125: Out-of-bounds Read •
CVSS: 3.9EPSS: 0%CPEs: 8EXPL: 0CVE-2020-13361
https://notcve.org/view.php?id=CVE-2020-13361
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation. En QEMU versión 5.0.0 y versiones anteriores, la función es1370_transfer_audio en el archivo hw/audio/es1370.c no comprueba apropiadamente el conteo de tramas, lo que permite a usuarios invitados del Sistema Operativo desencadenar un acceso fuera de límites durante una operación es1370_write(). • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html http://www.openwall.com/lists/oss-security/2020/05/28/1 https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03983.html https://security-tracker.debian.org/tracker/CVE-2020-13361 https://security.gentoo.org/glsa/202011-09 https://security.netapp.com/advisory/ntap-202 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-13253
https://notcve.org/view.php?id=CVE-2020-13253
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process. En la función sd_wp_addr en el archivo hw/sd/sd.c en QEMU versión 4.2.0, utiliza una dirección no comprobada, lo que conlleva a una lectura fuera de límites durante las operaciones sdhci_write(). Un usuario del Sistema Operativo invitado puede bloquear el proceso QEMU. • http://www.openwall.com/lists/oss-security/2020/05/27/2 https://bugzilla.redhat.com/show_bug.cgi?id=1838546 https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg05835.html https://security.gentoo.org/glsa/202011-09 https://usn.ubuntu.com/4467-1 • CWE-125: Out-of-bounds Read •
CVSS: 7.7EPSS: 0%CPEs: 8EXPL: 0CVE-2020-1711 – QEMU: block: iscsi: OOB heap access via an unexpected response of iSCSI Server
https://notcve.org/view.php?id=CVE-2020-1711
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host. Se detectó una fallo de acceso al búfer de la pila fuera de límites en la manera en que el controlador de iSCSI Block versiones 2.xx de QEMU hasta 2.12.0 incluyéndola, manejó una respuesta proveniente de un servidor iSCSI mientras se comprobaba el estado de un Logical Address Block (LBA) en una rutina iscsi_co_block_status(). Un usuario remoto podría usar este fallo para bloquear el proceso de QEMU, resultando en una denegación de servicio o posible ejecución de código arbitrario con privilegios del proceso de QEMU en el host. An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html https://access.redhat.com/errata/RHSA-2020:0669 https://access.redhat.com/errata/RHSA-2020:0730 https://access.redhat.com/errata/RHSA-2020:0731 https://access.redhat.com/errata/RHSA-2020:0773 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1711 https://lists.debian.org/debian-lts-announce/2020/03/msg00017.html https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html https://lists.gnu&# • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •