Use-after-free in QEMU - CVE-2020-15859

Vulnerability identifier: #VU31800

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-15859

CWE-ID: CWE-416

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in hw/net/e1000e_core.c when processing MMIO operation. A local user on guest operating system can send a specially crafted e1000e packet with the data's address set to the e1000e's MMIO address and crash the QEMU process.

QEMU
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• https://bugs.launchpad.net/qemu/+bug/1886362
• https://lists.gnu.org/archive/html/qemu-devel/2020-07/msg05304.html
• https://www.openwall.com/lists/oss-security/2020/07/21/3

• Multiple vulnerabilities in QEMU
• Red Hat Enterprise Linux 8 update for the virt:rhel and virt-devel:rhel modules