CVE-2020-10756

Se encontró una vulnerabilidad de lectura fuera de límites en la implementación de red SLiRP del emulador QEMU. Este fallo se produce en la rutina icmp6_send_echoreply() al responder a una petición echo ICMP, también se conoce como ping. Este fallo permite a un invitado malicioso filtrar el contenido de la memoria del host, resultando en una posible divulgación de información. Este fallo afecta a las versiones de libslirp anteriores a 4.3.1

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure.

This vulnerability allows local attackers to execute arbitrary code on affected installations of QEMU. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability.
The specific flaw exists within the handling of SLiRP networking. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the hypervisor.