CVE-2020-1983
published 2020-04-22CVE-2020-1983: A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
PriorityP427medium6.5CVSS 3.1
AVLACLPRLUINSCCNINAH
EPSS
2.29%
81.3th percentile
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | libslirp | < libslirp 4.2.0-2 (bookworm) | libslirp 4.2.0-2 (bookworm) |
| debian | qemu | < libslirp 4.2.0-2 (bookworm) | libslirp 4.2.0-2 (bookworm) |
| debian | slirp4netns | < libslirp 4.2.0-2 (bookworm) | libslirp 4.2.0-2 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| jenkins | jenkins_core | — | — |
| jenkins | jenkins_lts | — | — |
| jenkins | jenkins_weekly | — | — |
| libslirp_project | libslirp | <= 4.2.0 | — |
| libslirp_project | libslirp | >= 0 < 4.2.0-2 | 4.2.0-2 |
| libslirp_project | libslirp | >= 0 < 4.2.0-2 | 4.2.0-2 |
| libslirp_project | libslirp | >= 0 < 4.2.0-2 | 4.2.0-2 |
| libslirp_project | libslirp | >= 0 < 4.2.0-2 | 4.2.0-2 |
| opensuse | leap | — | — |
| qemu | qemu | >= 0 < 1:4.1-2 | 1:4.1-2 |
| qemu | qemu | >= 0 < 1:4.1-2 | 1:4.1-2 |
| qemu | qemu | >= 0 < 1:4.1-2 | 1:4.1-2 |
| qemu | qemu | >= 0 < 1:4.1-2 | 1:4.1-2 |
| qemu | qemu | >= 0 < 1:2.5+dfsg-5ubuntu10.44 | 1:2.5+dfsg-5ubuntu10.44 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
osv6.5MEDIUM
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
qemu vulnerabilities
osv·2024-11-08·CVSS 3.5
CVE-2019-20382 [LOW] qemu vulnerabilities
qemu vulnerabilities
It was discovered that QEMU incorrectly handled memory during certain VNC
operations. A remote attacker could possibly use this issue to cause QEMU
to consume resources, resulting in a denial of service. This issue only
affected Ubuntu 14.04 LTS. (CVE-2019-20382)
It was discovered that QEMU incorrectly handled certain memory copy
operations when loading ROM contents. If a user were tricked into running
an untrusted kernel image, a remote attacker could possibly use this issue
to run arbitrary code. This issue only affected Ubuntu 14.04 LTS.
(CVE-2020-13765)
Aviv Sasson discovered that QEMU incorrectly handled Slirp networking. A
remote attacker could use this issue to cause QEMU to crash, resulting in a
denial of service, or possibly execute arbitrary code. This iss
GHSA
GHSA-m3gw-pxj4-v7p8: A use after free vulnerability in ip_reass() in ip_input
ghsa_unreviewed·2022-05-24
CVE-2020-1983 [MEDIUM] CWE-416 GHSA-m3gw-pxj4-v7p8: A use after free vulnerability in ip_reass() in ip_input
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
OSV
qemu vulnerabilities
osv·2020-05-21·CVSS 5.8
CVE-2019-15034 [MEDIUM] qemu vulnerabilities
qemu vulnerabilities
It was discovered that QEMU incorrectly handled bochs-display devices. A
local attacker in a guest could use this to cause a denial of service or
possibly execute arbitrary code in the host. This issue only affected
Ubuntu 19.10. (CVE-2019-15034)
It was discovered that QEMU incorrectly handled memory during certain VNC
operations. A remote attacker could possibly use this issue to cause QEMU
to consume resources, resulting in a denial of service. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10.
(CVE-2019-20382)
It was discovered that QEMU incorrectly generated QEMU Pointer
Authentication signatures on ARM. A local attacker could possibly use this
issue to bypass PAuth. This issue only affected Ubuntu 19.10.
(CVE-2020-10702)
Ziming Zhan
OSV
CVE-2020-1983: A use after free vulnerability in ip_reass() in ip_input
osv·2020-04-22·CVSS 6.5
CVE-2020-1983 [MEDIUM] CVE-2020-1983: A use after free vulnerability in ip_reass() in ip_input
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
Red Hat
kernel: mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
vendor_redhat·2025-10-01·CVSS 5.5
CVE-2022-50430 [MEDIUM] CWE-820 kernel: mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
kernel: mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
In the Linux kernel, the following vulnerability has been resolved:
mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
vub300_enable_sdio_irq() works with mutex and need TASK_RUNNING here.
Ensure that we mark current as TASK_RUNNING for sleepable context.
[ 77.554641] do not call blocking ops when !TASK_RUNNING; state=1 set at [] sdio_irq_thread+0x17d/0x5b0
[ 77.554652] WARNING: CPU: 2 PID: 1983 at kernel/sched/core.c:9813 __might_sleep+0x116/0x160
[ 77.554905] CPU: 2 PID: 1983 Comm: ksdioirqd/mmc1 Tainted: G OE 6.1.0-rc5 #1
[ 77.554910] Hardware name: Intel(R) Client Systems NUC8i7BEH/NUC8BEB, BIOS BECFL357.86A.0081.2020.0504.1834 05/04/2020
[ 77.554912] RIP: 0010:__might_sleep+0x116/0x160
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2024-11-08·CVSS 3.5
CVE-2020-8608 [LOW] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
It was discovered that QEMU incorrectly handled memory during certain VNC
operations. A remote attacker could possibly use this issue to cause QEMU
to consume resources, resulting in a denial of service. This issue only
affected Ubuntu 14.04 LTS. (CVE-2019-20382)
It was discovered that QEMU incorrectly handled certain memory copy
operations when loading ROM contents. If a user were tricked into running
an untrusted kernel image, a remote attacker could possibly use this issue
to run arbitrary code. This issue only affected Ubuntu 14.04 LTS.
(CVE-2020-13765)
Aviv Sasson discovered that QEMU incorrectly handled Slirp networking. A
remote attacker could use this issue to cause QEMU to crash, resulting in a
de
Jenkins
Jenkins Security Advisory 2020-08-17
vendor_jenkins·2020-08-17·CVSS 9.4
CVE-2019-17638 [CRITICAL] Jenkins Security Advisory 2020-08-17
Title: Jenkins Security Advisory 2020-08-17
Jenkins Security Advisory 2020-08-17
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Jenkins (core)
Descriptions
Buffer corruption in bundled Jetty
SECURITY-1983
/
CVE-2019-17638
Severity (CVSS):
Critical
Description:
Jenkins bundles Winstone-Jetty, a wrapper ar
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2020-05-21·CVSS 5.8
CVE-2019-15034 [MEDIUM] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
It was discovered that QEMU incorrectly handled bochs-display devices. A
local attacker in a guest could use this to cause a denial of service or
possibly execute arbitrary code in the host. This issue only affected
Ubuntu 19.10. (CVE-2019-15034)
It was discovered that QEMU incorrectly handled memory during certain VNC
operations. A remote attacker could possibly use this issue to cause QEMU
to consume resources, resulting in a denial of service. This issue only
affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10.
(CVE-2019-20382)
It was discovered that QEMU incorrectly generated QEMU Pointer
Authentication signatures on ARM. A local attacker could possibly use this
issue to bypass PAuth. This is
Red Hat
QEMU: slirp: use-after-free in ip_reass() function in ip_input.c
vendor_redhat·2020-04-02·CVSS 7.5
CVE-2020-1983 [HIGH] CWE-416 QEMU: slirp: use-after-free in ip_reass() function in ip_input.c
QEMU: slirp: use-after-free in ip_reass() function in ip_input.c
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
A use-after-free flaw was found in the SLiRP networking implementation of the QEMU emulator. Specifically, this flaw occurs in the ip_reass() routine while reassembling incoming IP fragments whose combined size is bigger than 65k. This flaw allows an attacker to crash the QEMU process on the host, resulting in a denial of service.
Package: kvm (Red Hat Enterprise Linux 5) - Out of support scope
Package: qemu-kvm (Red Hat Enterprise Linux 6) - Will not fix
Package: slirp4netns (Red Hat Enterprise Linux 7) - Will not fix
Package: container-tools:1.0/slirp4netns (Red Hat Enter
Debian
CVE-2020-1983: libslirp - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and...
vendor_debian·2020·CVSS 7.5
CVE-2020-1983 [HIGH] CVE-2020-1983: libslirp - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and...
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
Scope: local
bookworm: resolved (fixed in 4.2.0-2)
bullseye: resolved (fixed in 4.2.0-2)
forky: resolved (fixed in 4.2.0-2)
sid: resolved (fixed in 4.2.0-2)
trixie: resolved (fixed in 4.2.0-2)
No detection rules found.
No public exploits indexed.
Unit42
Rootless Containers: The Next Trend in Container Security
blogs_unit42·2020-05-26
Rootless Containers: The Next Trend in Container Security
Threat Research Center
Threat Research
Cloud Cybersecurity Research
## Rootless Containers: The Next Trend in Container Security
Aviv Sasson
Published: May 26, 2020
Cloud Cybersecurity Research
Threat Research
Podman LXC Container Security
Rootless Containers
Slirp
## Executive Summary
As cloud computing evolves, containers continue to become more and more popular. New solutions and ideas to the way we implement containers are being introduced. One of these new ideas is rootless containers.
Rootless containers is a new concept of containers that don’t require root privileges in order to formulate. Many solutions have been proposed to overcome the technological challenges of creating a container with an unprivileged user, some of them are still under development and some ar
Unit42
Rootless Containers: The Next Trend in Container Security
blogs_unit42·2020-05-26
Rootless Containers: The Next Trend in Container Security
## Executive Summary
As cloud computing evolves, containers continue to become more and more popular. New solutions and ideas to the way we implement containers are being introduced. One of these new ideas is rootless containers.
Rootless containers is a new concept of containers that don’t require root privileges in order to formulate. Many solutions have been proposed to overcome the technological challenges of creating a container with an unprivileged user, some of them are still under development and some are production-ready. While rootless containers present some advantages, mainly from a security perspective, they are still in their early stages.
In this post, Unit 42 researcher Aviv Sasson reviews the internals of rootless containers. Aviv also presents a vulnerability he found
Bugzilla
CVE-2022-50430 kernel: mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
bugzilla·2025-10-01·CVSS 5.5
CVE-2022-50430 [MEDIUM] CVE-2022-50430 kernel: mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
CVE-2022-50430 kernel: mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
In the Linux kernel, the following vulnerability has been resolved:
mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
vub300_enable_sdio_irq() works with mutex and need TASK_RUNNING here.
Ensure that we mark current as TASK_RUNNING for sleepable context.
[ 77.554641] do not call blocking ops when !TASK_RUNNING; state=1 set at [] sdio_irq_thread+0x17d/0x5b0
[ 77.554652] WARNING: CPU: 2 PID: 1983 at kernel/sched/core.c:9813 __might_sleep+0x116/0x160
[ 77.554905] CPU: 2 PID: 1983 Comm: ksdioirqd/mmc1 Tainted: G OE 6.1.0-rc5 #1
[ 77.554910] Hardware name: Intel(R) Client Systems NUC8i7BEH/NUC8BEB, BIOS BECFL357.86A.0081.2020.0504.1834 05/04/2020
[ 77.554912] RIP: 0010:__might_
Bugzilla
CVE-2020-1983 qemu: slirp: use-after-free in ip_reass() function in ip_input.c [fedora-all]
bugzilla·2020-05-14·CVSS 7.5
CVE-2020-1983 [HIGH] CVE-2020-1983 qemu: slirp: use-after-free in ip_reass() function in ip_input.c [fedora-all]
CVE-2020-1983 qemu: slirp: use-after-free in ip_reass() function in ip_input.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supp
Bugzilla
CVE-2020-1983 libslirp: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [epel-8]
bugzilla·2020-04-30·CVSS 7.5
CVE-2020-1983 [HIGH] CVE-2020-1983 libslirp: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [epel-8]
CVE-2020-1983 libslirp: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [epel-8]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-8.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following templ
Bugzilla
CVE-2020-1983 QEMU: slirp: use-after-free in ip_reass() function in ip_input.c
bugzilla·2020-04-30·CVSS 7.5
CVE-2020-1983 [HIGH] CVE-2020-1983 QEMU: slirp: use-after-free in ip_reass() function in ip_input.c
CVE-2020-1983 QEMU: slirp: use-after-free in ip_reass() function in ip_input.c
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
Reference:
https://gitlab.freedesktop.org/slirp/libslirp/-/issues/20
Upstream commit:
https://gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb8c0a40f5d9f82a1c25129660e81df04
Discussion:
Created libslirp tracking bugs for this issue:
Affects: epel-8 [bug 1829827]
Affects: fedora-all [bug 1829826]
---
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.
---
Created qemu tra
Bugzilla
CVE-2020-1983 libslirp: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [fedora-all]
bugzilla·2020-04-30·CVSS 7.5
CVE-2020-1983 [HIGH] CVE-2020-1983 libslirp: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [fedora-all]
CVE-2020-1983 libslirp: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mul
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00022.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00001.htmlhttps://gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb8c0a40f5d9f82a1c25129660e81df04https://gitlab.freedesktop.org/slirp/libslirp/-/issues/20https://lists.debian.org/debian-lts-announce/2020/06/msg00032.htmlhttps://lists.debian.org/debian-lts-announce/2020/07/msg00020.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWFD4MWV3YWIHVHSA2F7FKOLJFL4PHOX/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKT2MTSINE4NUPG5L6BYH6N23NBNITOL/https://usn.ubuntu.com/4372-1/https://www.debian.org/security/2020/dsa-4665http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00022.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00001.htmlhttps://gitlab.freedesktop.org/slirp/libslirp/-/commit/9ac0371bb8c0a40f5d9f82a1c25129660e81df04https://gitlab.freedesktop.org/slirp/libslirp/-/issues/20https://lists.debian.org/debian-lts-announce/2020/06/msg00032.htmlhttps://lists.debian.org/debian-lts-announce/2020/07/msg00020.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWFD4MWV3YWIHVHSA2F7FKOLJFL4PHOX/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKT2MTSINE4NUPG5L6BYH6N23NBNITOL/https://usn.ubuntu.com/4372-1/https://www.debian.org/security/2020/dsa-4665
2020-04-22
Published