Out-of-bounds read in QEMU - CVE-2020-13253

Vulnerability identifier: #VU28283

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-13253

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in the SD Memory Card emulator while performing block write commands via sdhci_write() in QEMU. A remote user of guest operating system can trigger out-of-bounds read error and crash the QEMU process. 

QEMU
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Micro
Ubuntu
SUSE Linux Enterprise Realtime Extension
openEuler
qemu-ipxe
qemu-vgabios
qemu-seabios
qemu-system-misc (Ubuntu package)
qemu-system-mips (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu (Ubuntu package)
qemu-system-x86 (Ubuntu package)
qemu-system-aarch64 (Ubuntu package)
qemu-system (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu-audio-oss
qemu-s390
qemu-s390-debuginfo
qemu-ppc-debuginfo
qemu-ppc
qemu-x86
qemu-kvm
qemu-block-ssh-debuginfo
qemu-audio-sdl
qemu-guest-agent-debuginfo
qemu-block-rbd
qemu-block-curl-debuginfo
qemu
qemu-ui-gtk-debuginfo
qemu-ui-curses
qemu-ui-sdl-debuginfo
qemu-audio-pa
qemu-audio-pa-debuginfo
qemu-block-curl
qemu-ui-sdl
qemu-guest-agent
qemu-ui-curses-debuginfo
qemu-ui-gtk
qemu-debugsource
qemu-audio-sdl-debuginfo
qemu-arm
qemu-arm-debuginfo
qemu-tools-debuginfo
qemu-block-iscsi-debuginfo
qemu-tools
qemu-audio-alsa
qemu-lang
qemu-audio-oss-debuginfo
qemu-block-rbd-debuginfo
qemu-block-ssh
qemu-block-iscsi
qemu-audio-alsa-debuginfo
qemu-debuginfo
qemu-img
qemu-help
qemu-x86-debuginfo
qemu-ui-spice-app-debuginfo
qemu-ui-spice-app
qemu-microvm
qemu-system-x86-microvm (Ubuntu package)
qemu-system-x86-xen (Ubuntu package)
qemu-sgabios

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

qemu-ipxe - addressed in versions 1.0.0+-11.34.2, 1.0.0+-66.1
qemu-vgabios - addressed in versions 1.12.0_0_ga698c89-66.1, 1.12.1+-11.34.2
qemu-seabios - addressed in versions 1.12.0_0_ga698c89-66.1, 1.12.1+-11.34.2
qemu-system-misc (Ubuntu package) - update to 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-mips (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-ppc (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-x86 (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-aarch64 (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45
qemu-system (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-arm (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:4.2-3ubuntu6.4
qemu-system-sparc (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-s390x (Ubuntu package) - addressed in versions 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-audio-oss - update to 3.1.1.1-66.1
qemu-s390 - update to 3.1.1.1-66.1
qemu-s390-debuginfo - update to 3.1.1.1-66.1
qemu-ppc-debuginfo - update to 3.1.1.1-66.1
qemu-ppc - update to 3.1.1.1-66.1
qemu-x86 - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-kvm - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-block-ssh-debuginfo - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-audio-sdl - update to 3.1.1.1-66.1
qemu-guest-agent-debuginfo - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-block-rbd - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-block-curl-debuginfo - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-ui-gtk-debuginfo - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-ui-curses - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-ui-sdl-debuginfo - update to 3.1.1.1-66.1
qemu-audio-pa - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-audio-pa-debuginfo - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-block-curl - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-ui-sdl - update to 3.1.1.1-66.1
qemu-guest-agent - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-ui-curses-debuginfo - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-ui-gtk - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-debugsource - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-audio-sdl-debuginfo - update to 3.1.1.1-66.1
qemu-arm - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-arm-debuginfo - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-tools-debuginfo - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-block-iscsi-debuginfo - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-tools - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-audio-alsa - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-lang - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-audio-oss-debuginfo - update to 3.1.1.1-66.1
qemu-block-rbd-debuginfo - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-block-ssh - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-block-iscsi - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu-audio-alsa-debuginfo - addressed in versions 3.1.1.1-66.1, 4.2.1-11.34.2
qemu - update to 4.1.0-65
qemu-debugsource - update to 4.1.0-65
qemu-debuginfo - update to 4.1.0-65
qemu-block-rbd - update to 4.1.0-65
qemu-guest-agent - update to 4.1.0-65
qemu-img - update to 4.1.0-65
qemu-block-iscsi - update to 4.1.0-65
qemu-block-curl - update to 4.1.0-65
qemu-block-ssh - update to 4.1.0-65
qemu-help - update to 4.1.0-65
qemu-seabios - update to 4.1.0-65
qemu-x86-debuginfo - update to 4.2.1-11.34.2
qemu-ui-spice-app-debuginfo - update to 4.2.1-11.34.2
qemu-ui-spice-app - update to 4.2.1-11.34.2
qemu-debuginfo - update to 4.2.1-11.34.2
qemu-microvm - update to 4.2.1-11.34.2
qemu-system-x86-microvm (Ubuntu package) - update to 1:4.2-3ubuntu6.4
qemu-system-x86-xen (Ubuntu package) - update to 1:4.2-3ubuntu6.4
qemu-sgabios - addressed in versions 8-11.34.2, 8-66.1

• http://seclists.org/oss-sec/2020/q2/146
• https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg05877.html
• https://bugs.launchpad.net/qemu/+bug/1880822

• Denial of service in QEMU
• Gentoo update for QEMU
• Ubuntu update for qemu
• SUSE update for qemu
• SUSE update for qemu
• SUSE update for qemu
• openEuler update for qemu
• Ubuntu update for qemu