|Number of vulnerabilities||1|
|CVE ID|| CVE-2020-14364
|CWE ID|| CWE-787
|Exploitation vector||Local network|
|Public exploit||Public exploit code for vulnerability #1 is available.|
qemu (Alpine package)
Operating systems & Components / Operating system package or component
|Vendor||Alpine Linux Development Team|
This security advisory describes one medium risk vulnerability.
CVSSv3.1: 7.8 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]
CWE-787 - Out-of-bounds Write
Exploit availability: YesDescription
The vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to a boundary error within the USB emulator in QEMU. A remote user with access to guest operating system on the guest operating system can send specially crafted USB packets, trigger out-of-bounds write and execute arbitrary code on the host system.Mitigation
Install update from vendor's website.Vulnerable software versions
qemu (Alpine package): 4.0.1-r0, 4.2.0-r0, 4.2.0-r1, 4.2.0-r2, 5.1.0-r0CPE
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.