Out-of-bounds read in QEMU - CVE-2020-13362

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU31802

Out-of-bounds read in QEMU - CVE-2020-13362

Published: July 24, 2020


Vulnerability identifier: #VU31802
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-13362
CWE-ID: CWE-125
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in megasas_lookup_frame in hw/scsi/megasas.c. A local user on the guest operating system can pass specially crafted message with reply_queue_head field, trigger out-of-bounds read error and read contents of memory on the system.


Affected software

QEMU
Gentoo Linux
Debian Linux
Ubuntu
Opensuse
openEuler
qemu-system-misc (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-system-mips (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu (Ubuntu package)
qemu-system-x86 (Ubuntu package)
qemu-system-aarch64 (Ubuntu package)
qemu-system (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu (Debian package)
qemu-guest-agent
qemu
qemu-debuginfo
qemu-debugsource
qemu-help
qemu-img
qemu-seabios
qemu-system-x86-microvm (Ubuntu package)
qemu-system-x86-xen (Ubuntu package)

How to mitigate CVE-2020-13362

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

qemu-system-misc (Ubuntu package) - update to 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-sparc (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-mips (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-ppc (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-x86 (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-aarch64 (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45
qemu-system (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-arm (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:4.2-3ubuntu6.4
qemu-system-s390x (Ubuntu package) - addressed in versions 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu (Debian package) - update to 1:3.1+dfsg-8+deb10u6
qemu-guest-agent - update to 4.1.0-18
qemu - update to 4.1.0-18
qemu-debuginfo - update to 4.1.0-18
qemu-debugsource - update to 4.1.0-18
qemu-help - update to 4.1.0-18
qemu-img - update to 4.1.0-18
qemu-seabios - update to 4.1.0-18
qemu-system-x86-microvm (Ubuntu package) - update to 1:4.2-3ubuntu6.4
qemu-system-x86-xen (Ubuntu package) - update to 1:4.2-3ubuntu6.4

External References

Related Security Bulletins