CVE-2020-15859 — Use After Free in Qemu

CWE-416 — Use After Free10 documents8 sources
Severity
3.3LOWNVD
OSV3.8
EPSS
0.1%
top 67.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
QemuDebian QemuDebian Linux+3 more
Timeline
PublishedJul 21
Latest updateMay 24

Description

QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 1.8 | Impact: 1.4

Affected Packages7 packages

▶debiandebian/qemu< qemu 1:5.2+dfsg-1 (bookworm)
▶Debianqemu/qemu< 1:5.2+dfsg-1+3
▶Ubuntuqemu/qemu< 1:2.5+dfsg-5ubuntu10.49+2
▶NVDqemu/qemu4.2.0

Also affects: Debian Linux 10.0, 9.0

Patches

Patch: lists.gnu.org ↗Patch: www.openwall.com ↗Patch: lists.gnu.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-xvx4-fr25-r858: QEMU 4↗2022-05-24
▶
OSV
qemu vulnerabilities↗2021-02-08
▶
OSV
CVE-2020-15859: QEMU 4↗2020-07-21
▶

📋Vendor Advisories

4
Ubuntu
QEMU vulnerabilities↗2021-02-08
▶
Red Hat
QEMU: net: e1000e: use-after-free while sending packets↗2020-07-16
▶
Microsoft
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.↗2020-07-14
▶
Debian
CVE-2020-15859: qemu - QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user ...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-15859 qemu: net: e1000e: use-after-free while sending packets [fedora-all]↗2020-07-21
▶
Bugzilla
CVE-2020-15859 QEMU: net: e1000e: use-after-free while sending packets↗2020-07-21
▶