CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-20124
https://notcve.org/view.php?id=CVE-2018-20124
hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value. hw/rdma/rdma_backend.c en QEMU permite que los usuarios invitados del sistema operativo desencadenen un acceso fuera de límites mediante un elemento de anillo PvrdmaSqWqe con un valor num_sge grande. • http://www.openwall.com/lists/oss-security/2018/12/18/2 http://www.securityfocus.com/bid/106290 https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg02822.html https://usn.ubuntu.com/3923-1 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2018-20191
https://notcve.org/view.php?id=CVE-2018-20191
hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to uar_write), which allows attackers to cause a denial of service (NULL pointer dereference). hw/rdma/vmw/pvrdma_main.c en QEMU no implementa una operación de lectura (como uar_read por analogía con uar_write), lo que permite que los atacantes provoquen una denegación de servicio (desreferencia de puntero NULL). • http://www.openwall.com/lists/oss-security/2018/12/18/1 http://www.securityfocus.com/bid/106276 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGCFIFSIWUREEQQOZDZFBYKWZHXCWBZN https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJMTVGDLA654HNCDGLCUEIP36SNJEKK7 https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg03066.html https://usn.ubuntu.com/3923-1 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-20125
https://notcve.org/view.php?id=CVE-2018-20125
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in create_cq_ring or create_qp_rings. hw/rdma/vmw/pvrdma_cmd.c en QEMU permite que los atacantes provoquen una denegación de servicio (desreferencia de puntero NULL o asignación de memoria excesiva) en create_cq_ring o create_qp_rings. • http://www.openwall.com/lists/oss-security/2018/12/19/3 http://www.securityfocus.com/bid/106298 https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg02823.html https://usn.ubuntu.com/3923-1 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2018-20126
https://notcve.org/view.php?id=CVE-2018-20126
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled. hw/rdma/vmw/pvrdma_cmd.c en QEMU permite filtrados de memoria en create_cq y create_qp debido a la gestión incorrecta de los errores. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00034.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00038.html http://www.openwall.com/lists/oss-security/2018/12/19/4 http://www.securityfocus.com/bid/106298 https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg02824.html https://usn.ubuntu.com/3923-1 • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-20216
https://notcve.org/view.php?id=CVE-2018-20216
QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled). QEMU puede tener un bucle infinito en hw/rdma/vmw/pvrdma_dev_ring.c debido a que no se comprueban los valores de retorno (y -1 se gestiona de manera incorrecta). • http://www.openwall.com/lists/oss-security/2018/12/19/2 http://www.securityfocus.com/bid/106291 https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg03052.html https://usn.ubuntu.com/3923-1 • CWE-252: Unchecked Return Value CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •