CVE-2020-13754 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Qemu

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-125 — Out-of-bounds ReadCWE-787 — Out-of-bounds Write15 documents9 sources
Severity
6.7MEDIUMNVD
OSV6.5OSV5.5
EPSS
0.0%
top 91.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
QemuCanonical Ubuntu LinuxDebian Linux
Timeline
PublishedJun 2
Latest updateMay 24

Description

hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages3 packages

▶Debianqemu/qemu< 1:5.0-6+3
▶Ubuntuqemu/qemu< 1:2.5+dfsg-5ubuntu10.45+6
▶NVDqemu/qemu5.0.1

Also affects: Debian Linux 10.0, 9.0, Ubuntu Linux 16.04, 18.04, 20.04

Patches

Patch: www.openwall.com ↗Patch: www.openwall.com ↗Patch: lists.gnu.org ↗

🔴Vulnerability Details

6
GHSA
GHSA-7f7c-v5j3-cchv: hw/pci/msix↗2022-05-24
▶
OSV
qemu regression↗2021-02-22
▶
OSV
qemu vulnerabilities↗2021-02-02
▶
OSV
qemu vulnerabilities↗2020-08-19
▶
CVEList
CVE-2020-13754: hw/pci/msix↗2020-06-02
▶

📋Vendor Advisories

6
Ubuntu
QEMU regression↗2021-02-22
▶
Ubuntu
QEMU vulnerabilities↗2021-02-02
▶
Ubuntu
QEMU vulnerabilities↗2020-08-19
▶
Microsoft
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.↗2020-06-09
▶
Red Hat
QEMU: msix: OOB access during mmio operations may lead to DoS↗2020-06-01
▶

💬Community

2
Bugzilla
CVE-2020-13754 QEMU: msix: OOB access during mmio operations may lead to DoS↗2020-06-01
▶
Bugzilla
CVE-2020-13754 qemu: msix: OOB access during mmio operations may lead to DoS [fedora-all]↗2020-06-01
▶
CVE-2020-13754 — Qemu vulnerability | cvebase