CVE-2020-14364
Severity
5.0MEDIUM
EPSS
13.9%
top 5.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 31
Latest updateMay 24
Description
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:LExploitability: 0.8 | Impact: 3.7
Affected Packages5 packages
Also affects: Debian Linux 10.0, 9.0, Fedora 31, 32, Ubuntu Linux 16.04, 18.04, 20.04, Enterprise Linux 6.0, 7.0, 8.0
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-fq9g-vccc-q7c7: An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5↗2022-05-24
CVEList▶
CVE-2020-14364: An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5↗2020-08-31
OSV▶
CVE-2020-14364: An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5↗2020-08-31
📋Vendor Advisories
5Microsoft▶
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' excee↗2020-08-11
Debian▶
CVE-2020-14364: qemu - An out-of-bounds read/write access flaw was found in the USB emulator of the QEM...↗2020