Description
An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS). Note: This is disputed as a bug and not a valid security issue by multiple third parties.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 2.0 | Impact: 6.0Attack Vector: Local
Complexity: Low
Privileges: Low
User Interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High
Affected Packages3 packages
Also affects: Debian Linux 10.0
🔴Vulnerability Details
5OSVqemu regression↗2024-06-06 OSVqemu vulnerabilities↗2024-01-08 OSVCVE-2020-24165: An issue was discovered in TCG Accelerator in QEMU 4↗2023-08-28 GHSAGHSA-xc5f-ww2c-46pr: An issue was discovered in TCG Accelerator in QEMU 4↗2023-08-28 CVEListCVE-2020-24165: An issue was discovered in TCG Accelerator in QEMU 4↗2023-08-28 📋Vendor Advisories
4UbuntuQEMU regression↗2024-06-06 UbuntuQEMU vulnerabilities↗2024-01-08 Red HatQEMU: use-after-free in TCG accelerator can lead to local privilege escalation↗2023-08-28 DebianCVE-2020-24165: qemu - An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers...↗2020