CVSS: 3.2EPSS: 0%CPEs: 8EXPL: 0CVE-2020-13362
https://notcve.org/view.php?id=CVE-2020-13362
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user. En QEMU versión 5.0.0 y versiones anteriores, la función megasas_lookup_frame en el archivo hw/scsi/megasas.c presenta una lectura fuera de límites mediante el campo reply_queue_head desde un usuario invitado del Sistema Operativo. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html http://www.openwall.com/lists/oss-security/2020/05/28/2 https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03131.html https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg06250.html https://security-tracker.debian.org/tracker/CVE-2020-13362 https://security • CWE-125: Out-of-bounds Read •
CVSS: 3.9EPSS: 0%CPEs: 8EXPL: 0CVE-2020-13361
https://notcve.org/view.php?id=CVE-2020-13361
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation. En QEMU versión 5.0.0 y versiones anteriores, la función es1370_transfer_audio en el archivo hw/audio/es1370.c no comprueba apropiadamente el conteo de tramas, lo que permite a usuarios invitados del Sistema Operativo desencadenar un acceso fuera de límites durante una operación es1370_write(). • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html http://www.openwall.com/lists/oss-security/2020/05/28/1 https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg03983.html https://security-tracker.debian.org/tracker/CVE-2020-13361 https://security.gentoo.org/glsa/202011-09 https://security.netapp.com/advisory/ntap-202 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-13253
https://notcve.org/view.php?id=CVE-2020-13253
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process. En la función sd_wp_addr en el archivo hw/sd/sd.c en QEMU versión 4.2.0, utiliza una dirección no comprobada, lo que conlleva a una lectura fuera de límites durante las operaciones sdhci_write(). Un usuario del Sistema Operativo invitado puede bloquear el proceso QEMU. • http://www.openwall.com/lists/oss-security/2020/05/27/2 https://bugzilla.redhat.com/show_bug.cgi?id=1838546 https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg05835.html https://security.gentoo.org/glsa/202011-09 https://usn.ubuntu.com/4467-1 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10702
https://notcve.org/view.php?id=CVE-2020-10702
A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU. Se encontró un fallo en QEMU en la implementación del soporte Pointer Authentication (PAuth) para ARM introducido en la versión 4.0 y corregido en la versión 5.0.0. Un fallo general del proceso de generación de firmas causó que cada puntero aplicado por PAuth se firmara con la misma firma. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10702 https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=de0b1bae6461f67243282555475f88b2384a1eb9 https://security.netapp.com/advisory/ntap-20200724-0007 • CWE-325: Missing Cryptographic Step •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10717
https://notcve.org/view.php?id=CVE-2020-10717
A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs is meant to share a host file system directory with a guest via virtio-fs device. If the guest opens the maximum number of file descriptors under the shared directory, a denial of service may occur. This flaw allows a guest user/process to cause this denial of service on the host. Se encontró un fallo potencial de DoS en la implementación del demonio del sistema de archivos compartido virtio-fs (virtiofsd) de QEMU versiones anteriores a la versión v5.0. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10717 https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg00141.html https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg00143.html https://security.gentoo.org/glsa/202011-09 https://www.openwall.com/lists/oss-security/2020/05/04/1 • CWE-770: Allocation of Resources Without Limits or Throttling •