Infinite loop in QEMU - CVE-2020-13800

Vulnerability identifier: #VU31808

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-13800

CWE-ID: CWE-835

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in ati-vga in hw/display/ati.c. A local user on the guest operating system can trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call and perform a denial of service attack against the host system.

QEMU
Gentoo Linux
Opensuse
Ubuntu
openEuler
qemu-system-aarch64 (Ubuntu package)
qemu-system-x86 (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu (Ubuntu package)
qemu-system-mips (Ubuntu package)
qemu-system (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-seabios
qemu-debuginfo
qemu-debugsource
qemu-guest-agent
qemu-help
qemu-img
qemu
qemu-system-x86-microvm (Ubuntu package)
qemu-system-x86-xen (Ubuntu package)

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

qemu-system-aarch64 (Ubuntu package) - update to 1:2.5+dfsg-5ubuntu10.45
qemu-system-x86 (Ubuntu package) - addressed in versions 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-sparc (Ubuntu package) - addressed in versions 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-s390x (Ubuntu package) - addressed in versions 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-ppc (Ubuntu package) - addressed in versions 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu (Ubuntu package) - addressed in versions 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-mips (Ubuntu package) - addressed in versions 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system (Ubuntu package) - addressed in versions 1:2.5+dfsg-5ubuntu10.45, 1:2.11+dfsg-1ubuntu7.31, 1:4.2-3ubuntu6.4
qemu-system-arm (Ubuntu package) - addressed in versions 1:2.5+dfsg-5ubuntu10.45, 1:4.2-3ubuntu6.4
qemu-seabios - update to 4.1.0-18
qemu-debuginfo - update to 4.1.0-18
qemu-debugsource - update to 4.1.0-18
qemu-guest-agent - update to 4.1.0-18
qemu-help - update to 4.1.0-18
qemu-img - update to 4.1.0-18
qemu - update to 4.1.0-18
qemu-system-x86-microvm (Ubuntu package) - update to 1:4.2-3ubuntu6.4
qemu-system-x86-xen (Ubuntu package) - update to 1:4.2-3ubuntu6.4

• https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00825.html
• https://security.netapp.com/advisory/ntap-20200717-0001/
• https://www.openwall.com/lists/oss-security/2020/06/04/2

• Multiple vulnerabilities in QEMU
• OpenSUSE Linux update for qemu
• Gentoo update for QEMU
• openEuler 20.03 LTS update for qemu
• Ubuntu update for qemu