Out-of-bounds write in QEMU - CVE-2020-13754

Vulnerability identifier: #VU31803

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-13754

CWE-ID: CWE-787

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in hw/pci/msix.c. A local user on the guest operating system can send specially crafted address in an msi-x mmio operation, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code.

QEMU
Gentoo Linux
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE CaaS Platform
Ubuntu
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
openSUSE Leap
Red Hat Enterprise Linux Advanced Virtualization
qemu-ipxe
qemu-seabios
qemu-vgabios
qemu-system-misc (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-system (Ubuntu package)
qemu-system-aarch64 (Ubuntu package)
qemu-system-x86 (Ubuntu package)
qemu (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-system-mips (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu (Debian package)
qemu-audio-pa
qemu-ui-sdl
qemu-ui-curses-debuginfo
qemu-ui-gtk
qemu-lang
qemu-audio-alsa
qemu-block-iscsi-debuginfo
qemu-tools-debuginfo
qemu-arm-debuginfo
qemu-arm
qemu-tools
qemu-kvm
qemu-x86
qemu-ppc
qemu-ppc-debuginfo
qemu-s390-debuginfo
qemu-s390
qemu
qemu-audio-sdl
qemu-ui-curses
qemu-block-ssh-debuginfo
qemu-audio-oss
qemu-audio-oss-debuginfo
qemu-block-rbd-debuginfo
qemu-block-ssh
qemu-block-iscsi
qemu-audio-alsa-debuginfo
qemu-debugsource
qemu-audio-sdl-debuginfo
qemu-ui-gtk-debuginfo
qemu-guest-agent-debuginfo
qemu-block-rbd
qemu-block-curl-debuginfo
qemu-ui-sdl-debuginfo
qemu-audio-pa-debuginfo
qemu-block-curl
qemu-guest-agent
qemu-debuginfo
qemu-x86-debuginfo
qemu-ui-spice-app
qemu-microvm
qemu-ui-spice-app-debuginfo
qemu-system-x86-microvm (Ubuntu package)
qemu-system-x86-xen (Ubuntu package)
qemu-sgabios

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

qemu-ipxe - addressed in versions 1.0.0+-66.1, 1.0.0+-150100.80.51.5, 1.0.0+-150200.79.1
qemu-seabios - addressed in versions 1.12.0_0_ga698c89-66.1, 1.12.0_0_ga698c89-150100.80.51.5, 1.12.1+-150200.79.1
qemu-vgabios - addressed in versions 1.12.0_0_ga698c89-66.1, 1.12.0_0_ga698c89-150100.80.51.5, 1.12.1+-150200.79.1
qemu-system-misc (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.51, 1:2.11+dfsg-1ubuntu7.36, 1:4.2-3ubuntu6.14, 1:5.0-5ubuntu9.6
qemu-system-arm (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.5+dfsg-5ubuntu10.51, 1:2.11+dfsg-1ubuntu7.36, 1:4.2-3ubuntu6.4, 1:4.2-3ubuntu6.14, 1:5.0-5ubuntu9.6
qemu-system (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.5+dfsg-5ubuntu10.51, 1:2.11+dfsg-1ubuntu7.31, 1:2.11+dfsg-1ubuntu7.36, 1:4.2-3ubuntu6.4, 1:4.2-3ubuntu6.14, 1:5.0-5ubuntu9.6
qemu-system-aarch64 (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.5+dfsg-5ubuntu10.51
qemu-system-x86 (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.5+dfsg-5ubuntu10.51, 1:2.11+dfsg-1ubuntu7.31, 1:2.11+dfsg-1ubuntu7.36, 1:4.2-3ubuntu6.4, 1:4.2-3ubuntu6.14, 1:5.0-5ubuntu9.6
qemu (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.5+dfsg-5ubuntu10.51, 1:2.11+dfsg-1ubuntu7.31, 1:2.11+dfsg-1ubuntu7.36, 1:4.2-3ubuntu6.4, 1:4.2-3ubuntu6.14, 1:5.0-5ubuntu9.6
qemu-system-ppc (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.5+dfsg-5ubuntu10.51, 1:2.11+dfsg-1ubuntu7.31, 1:2.11+dfsg-1ubuntu7.36, 1:4.2-3ubuntu6.4, 1:4.2-3ubuntu6.14, 1:5.0-5ubuntu9.6
qemu-system-sparc (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.5+dfsg-5ubuntu10.51, 1:2.11+dfsg-1ubuntu7.31, 1:2.11+dfsg-1ubuntu7.36, 1:4.2-3ubuntu6.4, 1:4.2-3ubuntu6.14, 1:5.0-5ubuntu9.6
qemu-system-mips (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.47+esm1, 1:2.5+dfsg-5ubuntu10.45, 1:2.5+dfsg-5ubuntu10.51, 1:2.11+dfsg-1ubuntu7.31, 1:2.11+dfsg-1ubuntu7.36, 1:4.2-3ubuntu6.4, 1:4.2-3ubuntu6.14, 1:5.0-5ubuntu9.6
qemu-system-s390x (Ubuntu package) - addressed in versions 1:2.5+dfsg-5ubuntu10.45, 1:2.5+dfsg-5ubuntu10.51, 1:2.11+dfsg-1ubuntu7.31, 1:2.11+dfsg-1ubuntu7.36, 1:4.2-3ubuntu6.4, 1:4.2-3ubuntu6.14, 1:5.0-5ubuntu9.6
qemu (Debian package) - addressed in versions 1:3.1+dfsg-8+deb10u6, 1:3.1+dfsg-8+deb10u7
qemu-audio-pa - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-ui-sdl - update to 3.1.1.1-66.1
qemu-ui-curses-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-ui-gtk - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-lang - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-audio-alsa - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-block-iscsi-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-tools-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-arm-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-arm - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-tools - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-kvm - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-x86 - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-ppc - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-ppc-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-s390-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-s390 - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-audio-sdl - update to 3.1.1.1-66.1
qemu-ui-curses - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-block-ssh-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-audio-oss - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5
qemu-audio-oss-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5
qemu-block-rbd-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-block-ssh - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-block-iscsi - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-audio-alsa-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-debugsource - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-audio-sdl-debuginfo - update to 3.1.1.1-66.1
qemu-ui-gtk-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-guest-agent-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-block-rbd - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-block-curl-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-ui-sdl-debuginfo - update to 3.1.1.1-66.1
qemu-audio-pa-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-block-curl - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-guest-agent - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-debuginfo - addressed in versions 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-x86-debuginfo - addressed in versions 3.1.1.1-150100.80.51.5, 4.2.1-150200.79.1
qemu-ui-spice-app - update to 4.2.1-150200.79.1
qemu-microvm - update to 4.2.1-150200.79.1
qemu-ui-spice-app-debuginfo - update to 4.2.1-150200.79.1
qemu-system-x86-microvm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.4, 1:4.2-3ubuntu6.14, 1:5.0-5ubuntu9.6
qemu-system-x86-xen (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.4, 1:4.2-3ubuntu6.14, 1:5.0-5ubuntu9.6
qemu-sgabios - addressed in versions 8-66.1, 8-150100.80.51.5, 8-150200.79.1

• http://www.openwall.com/lists/oss-security/2020/06/01/6
• http://www.openwall.com/lists/oss-security/2020/06/15/8
• https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00004.html
• https://security.netapp.com/advisory/ntap-20200608-0007/
• https://www.debian.org/security/2020/dsa-4728

• Multiple vulnerabilities in QEMU
• Gentoo update for QEMU
• Advanced Virtualization for RHEL 8 update for the virt:8.2 and virt-devel:8.2 modules
• Ubuntu update for qemu
• Ubuntu update for qemu
• Debian update for qemu
• Debian update for qemu
• SUSE update for qemu
• SUSE update for qemu
• SUSE update for qemu
• Ubuntu update for qemu