Heap-based buffer overflow in QEMU - CVE-2020-1711

Vulnerability identifier: #VU25510

CSH Severity: Medium

CVSS v4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-1711

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a boundary error in the way the iSCSI Block driver handles a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an "iscsi_co_block_status()" routine. A remote authenticated attacker can trigger heap-based buffer overflow and cause a denial of service condition or potentially execute arbitrary code with privileges of the QEMU process on the host.

QEMU
Red Hat Virtualization Manager
Gentoo Linux
Debian Linux
Arch Linux
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Opensuse
qemu-kvm-rhev (Red Hat package)
qemu (Debian package)
qemu-kvm-ma (Red Hat package)
Red Hat Virtualization
Red Hat Virtualization for IBM Power LE
Red Hat OpenStack
Red Hat OpenStack for IBM Power

Install updates from vendor's website.

QEMU - update to 4.2.1
qemu-kvm-rhev (Red Hat package) - addressed in versions 2.12.0-33.el7_7.10, 2.12.0-44.el7
qemu (Debian package) - addressed in versions 1:2.8+dfsg-6+deb9u9, 1:3.1+dfsg-8+deb10u4
qemu-kvm-ma (Red Hat package) - addressed in versions 2.10.0-21.el7_5.5, 2.12.0-33.el7_7.3, 2.12.0-44.el7

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1711
• https://lists.gnu.org/archive/html/qemu-devel/2020-01/msg05535.html
• https://www.openwall.com/lists/oss-security/2020/01/23/3

• Denial of service in QEMU
• Red Hat Enterprise Linux 7.6 update for qemu-kvm-ma
• Red Hat update for virt:8.1 and virt-devel:8.1
• Red Hat Virtualization Engine 4.2 update for qemu-kvm-rhev
• Red Hat OpenStack - Extended Update Support 13 for RHEL 7.6 update for qemu-kvm-rhev
• Red Hat Virtualization 4 update for qemu-kvm-rhev
• Red Hat Enterprise Linux 7 update for qemu-kvm-ma
• Red Hat Enterprise Linux 7 update for qemu-kvm-ma
• Red Hat OpenStack Platform 10 update for qemu-kvm-rhev
• Red Hat OpenStack Platform 13 update for qemu-kvm-rhev
• OpenSUSE Linux update for qemu
• Arch Linux update for qemu
• Gentoo update for QEMU
• Red Hat Enterprise Linux 7 update for qemu-kvm-ma
• Debian update for qemu
• Red Hat Enterprise Linux 7.7 Extended Update Support update for qemu-kvm-ma
• Red Hat Enterprise Linux 8 update for the virt:rhel and virt-devel:rhel modules