Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 110

Export CSV
CVE-2020-35517

QEMU: virtiofsd: potential privileged host device access from guest

A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to create a device special file in the shared directory and use it to r/w access host devices.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Advanced Virtualization Enterprise Linux
CVE-2020-27821

QEMU: heap buffer overflow in msix_table_mmio_write() in hw/pci/msix.c

A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service. This flaw affects QEMU versions prior to 5.2.0.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Advanced Virtualization and 1 more
CVE-2020-27617

QEMU: net: an assert failure via eth_get_gso_type

eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.

CVSS 3.1 · 6.5 Medium EPSS 2.6% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Advanced Virtualization and 1 more
CVE-2020-25723

QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c

A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Advanced Virtualization and 2 more
CVE-2020-25637

libvirt: double free in qemuAgentGetInterfaces() in qemu_agent.c

A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse Redhat
Products
Leap Advanced Virtualization Enterprise Linux and 1 more
CVE-2020-1983

libslirp: use after free vulnerability cause a denial of service.

A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 6 more
CVE-2020-1711

QEMU: block: iscsi: OOB heap access via an unexpected response of iSCSI Server

An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.

CVSS 3.1 · 7.7 High EPSS 4.0% KEV · Not listed
Vendors
Debian Opensuse Qemu and 1 more
Products
Debian Linux Leap Qemu and 6 more
CVE-2020-16092

QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c

In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Opensuse and 2 more
Products
Ubuntu Linux Debian Linux Leap and 5 more
CVE-2020-14364

QEMU: usb: out-of-bounds r/w access issue while processing usb packets

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.

CVSS 3.1 · 5.0 Medium EPSS 5.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 11 more
CVE-2020-14339

libvirt: leak of /dev/mapper/control into QEMU guests

A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Advanced Virtualization Enterprise Linux Libvirt
CVE-2020-14301

libvirt: leak of sensitive cookie information via dumpxml

An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker to access potentially sensitive information in the domain configuration via the `dumpxml` command.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Netapp Redhat
Products
Ontap Select Deploy Administration Utility Advanced Virtualization Codeready Linux Builder and 11 more
CVE-2020-13754

QEMU: msix: OOB access during mmio operations may lead to DoS

hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 2 more
CVE-2020-11947

QEMU: heap buffer overflow in iscsi_aio_ioctl_cb() in block/iscsi.c may lead to information disclosure

iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Advanced Virtualization Enterprise Linux
CVE-2020-10761

QEMU: nbd: reachable assertion failure in nbd_negotiate_send_rep_verr via remote client

An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server resulting in a denial of service.

CVSS 3.1 · 5 Medium EPSS 1.8% KEV · Not listed
Vendors
Canonical Opensuse Qemu and 1 more
Products
Ubuntu Linux Leap Qemu and 2 more
CVE-2020-10756

QEMU: slirp: networking out-of-bounds read information disclosure vulnerability

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Libslirp Project and 2 more
Products
Ubuntu Linux Debian Linux Libslirp and 4 more
CVE-2020-10717

QEMU: virtiofsd: guest may open maximum file descriptor to cause DoS

A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs is meant to share a host file system directory with a guest via virtio-fs device. If the guest opens the maximum number of file descriptors under the shared directory, a denial of service may occur. This flaw allows a guest user/process to cause this denial of service on the host.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Advanced Virtualization
CVE-2020-10702

qemu: weak signature generation in Pointer Authentication support for ARM

A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Advanced Virtualization
CVE-2019-9755

ntfs-3g: heap-based buffer overflow leads to local root privilege escalation

An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Redhat Tuxera
Products
Advanced Virtualization Enterprise Linux Enterprise Linux Eus and 4 more
CVE-2019-3886

libvirt: virsh domhostname command discloses guest hostname in readonly mode

An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block.

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed
Vendors
Fedoraproject Opensuse Redhat
Products
Fedora Leap Advanced Virtualization and 1 more