CVE-2020-25085

QEMU versión 5.0.0, presenta un desbordamiento de búfer en la región heap de la memoria en la función flatview_read_continue en el archivo exec.c porque el archivo hw/sd/sdhci.c maneja inapropiadamente una operación de escritura en el caso SDHC_BLKSIZE

Alexander Bulekov discovered that QEMU incorrectly handled SDHCI device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that QEMU incorrectly handled USB device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. Various other issues were also addressed.