Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 429

Export CSV
CVE-2020-35503

QEMU: NULL pointer dereference issue in megasas-gen2 host bus adapter

A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. This issue occurs in the megasas_command_cancelled() callback function while dropping a SCSI request. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Qemu
Products
Fedora Qemu
CVE-2020-27821

QEMU: heap buffer overflow in msix_table_mmio_write() in hw/pci/msix.c

A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service. This flaw affects QEMU versions prior to 5.2.0.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Advanced Virtualization and 1 more
CVE-2020-27661

QEMU: divide by zero in dwc2_handle_packet() in hw/usb/hcd-dwc2.c

A divide-by-zero issue was found in dwc2_handle_packet in hw/usb/hcd-dwc2.c in the hcd-dwc2 USB host controller emulation of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2020-27617

QEMU: net: an assert failure via eth_get_gso_type

eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.

CVSS 3.1 · 6.5 Medium EPSS 2.6% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Advanced Virtualization and 1 more
CVE-2020-27616

QEMU: ati-vga: potential crash via invalid x y parameter values

ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2020-25743

QEMU: ide: null pointer dereference while cancelling i/o operation

hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack Platform
CVE-2020-25742

QEMU: scsi: lsi: null pointer dereference during memory move

pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2020-25741

QEMU: fdc: null pointer dereference during r/w data transfer

fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2020-25723

QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c

A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Advanced Virtualization and 2 more
CVE-2020-25625

QEMU: usb: hcd-ohci: infinite loop issue while processing transfer descriptors

hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2020-25624

QEMU: usb: hcd-ohci: out-of-bound access issue while processing transfer descriptors

hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.

CVSS 3.1 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2020-25085

QEMU: sdhci: out-of-bounds access issue while doing multi block SDMA

QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.

CVSS 3.1 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2020-25084

QEMU: usb: use-after-free issue while setting up packet

QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2020-24352

QEMU: out-of-bounds read/write in ati-vga device emulation in ati_2d_blt()

An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu
Products
Qemu
CVE-2020-24165

QEMU: use-after-free in TCG accelerator can lead to local privilege escalation

An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS). Note: This is disputed as a bug and not a valid security issue by multiple third parties.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2020-1711

QEMU: block: iscsi: OOB heap access via an unexpected response of iSCSI Server

An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.

CVSS 3.1 · 7.7 High EPSS 4.0% KEV · Not listed
Vendors
Debian Opensuse Qemu and 1 more
Products
Debian Linux Leap Qemu and 6 more
CVE-2020-17380

QEMU: heap buffer overflow in sdhci_sdma_transfer_multi_blocks() in hw/sd/sdhci.c

A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support. It could occur while doing a multi block SDMA transfer via the sdhci_sdma_transfer_multi_blocks() routine in hw/sd/sdhci.c. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code with privileges of the QEMU process on the host.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu
Products
Debian Linux Qemu
CVE-2020-16092

QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c

In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Leap and 5 more