CVE-2020-27617 — Reachable Assertion in Qemu

CWE-617 — Reachable Assertion9 documents7 sources
Severity
6.5MEDIUMNVD
OSV6.3
EPSS
0.2%
top 54.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
QemuDebian QemuDebian Linux
Timeline
PublishedNov 6
Latest updateMay 24

Description

eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/qemu< qemu 1:5.2+dfsg-1 (bookworm)
▶Debianqemu/qemu< 1:5.2+dfsg-1+3
▶Ubuntuqemu/qemu< 1:2.5+dfsg-5ubuntu10.48+2
▶NVDqemu/qemu4.2.1

Also affects: Debian Linux 10.0, 9.0

Patches

Patch: www.openwall.com ↗Patch: lists.nongnu.org ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-rxvx-vx9w-jw3j: eth_get_gso_type in net/eth↗2022-05-24
▶
OSV
qemu vulnerabilities↗2020-11-30
▶
OSV
CVE-2020-27617: eth_get_gso_type in net/eth↗2020-11-06
▶

📋Vendor Advisories

3
Ubuntu
QEMU vulnerabilities↗2020-11-30
▶
Red Hat
QEMU: net: an assert failure via eth_get_gso_type↗2020-10-20
▶
Debian
CVE-2020-27617: qemu - eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an ...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-27617 QEMU: net: an assert failure via eth_get_gso_type↗2020-10-27
▶
Bugzilla
CVE-2020-27617 qemu: net: an assert failure via eth_get_gso_type [fedora-all]↗2020-10-27
▶