Multiple vulnerabilities in QEMU
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2019-12068 CVE-2019-20382 |
| CWE-ID | CWE-835 CWE-401 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
QEMU Client/Desktop applications / Virtualization software |
| Vendor | QEMU |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
Updated: 28.04.2020
Updated list of vulnerabilities, changed bulletin status to patched.
1) Infinite loop
EUVDB-ID: #VU22783
Risk: Low
CVSSv3.1: 5.1 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2019-12068
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in lsi_execute_script() when reading empty opcode. A local user can consume all available system resources and cause denial of service conditions.
MitigationInstall update from vendor's website.
Vulnerable software versionsQEMU: 2.1.0 - 4.1.0
External linkshttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00034.html
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00038.html
http://git.qemu.org/?p=qemu.git;a=commit;h=de594e47659029316bbf9391efb79da0a1a08e08
http://lists.debian.org/debian-lts-announce/2019/09/msg00021.html
http://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01518.html
http://security-tracker.debian.org/tracker/CVE-2019-12068
http://usn.ubuntu.com/4191-2/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Memory leak
EUVDB-ID: #VU27388
Risk: Medium
CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-20382
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the zrle_compress_data() function in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd. A remote attacker can perform a denial of service attack.
Install update from vendor's website.
Vulnerable software versionsQEMU: 4.1.0
External linkshttp://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html
http://www.openwall.com/lists/oss-security/2020/03/05/1
http://git.qemu.org/?p=qemu.git;a=commit;h=6bf21f3d83e95bcc4ba35a7a07cc6655e8b010b0
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
