Heap-based buffer overflow in QEMU - CVE-2020-17380

Vulnerability identifier: #VU68558

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-17380

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the SDHCI device emulation support while performing a multi block SDMA transfer via the sdhci_sdma_transfer_multi_blocks() routine in hw/sd/sdhci.c. A remote user of the guest OS can trigger a heap-based buffer overflow and crash the QEMU process on the host OS.

QEMU
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE CaaS Platform
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
qemu-ipxe
qemu-vgabios
qemu-seabios
qemu-audio-sdl-debuginfo
qemu-guest-agent-debuginfo
qemu-block-rbd
qemu-block-curl-debuginfo
qemu-ui-gtk-debuginfo
qemu-ui-sdl-debuginfo
qemu-audio-pa-debuginfo
qemu-block-curl
qemu-guest-agent
qemu-audio-pa
qemu-debugsource
qemu-audio-alsa-debuginfo
qemu-block-iscsi
qemu-block-ssh
qemu-block-rbd-debuginfo
qemu-audio-oss-debuginfo
qemu-block-iscsi-debuginfo
qemu-s390
qemu-s390-debuginfo
qemu-ppc-debuginfo
qemu-ppc
qemu-x86
qemu-kvm
qemu-arm
qemu-arm-debuginfo
qemu-tools-debuginfo
qemu
qemu-tools
qemu-audio-alsa
qemu-lang
qemu-ui-gtk
qemu-ui-curses-debuginfo
qemu-ui-sdl
qemu-block-ssh-debuginfo
qemu-ui-curses
qemu-audio-oss
qemu-audio-sdl
qemu-debuginfo
qemu-x86-debuginfo
qemu-sgabios

Install updates from vendor's website.

qemu-ipxe - addressed in versions 1.0.0+-66.1, 1.0.0+-150100.80.43.2
qemu-vgabios - addressed in versions 1.12.0_0_ga698c89-66.1, 1.12.0_0_ga698c89-150100.80.43.2
qemu-seabios - addressed in versions 1.12.0_0_ga698c89-66.1, 1.12.0_0_ga698c89-150100.80.43.2
qemu-audio-sdl-debuginfo - update to 3.1.1.1-66.1
qemu-guest-agent-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-block-rbd - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-block-curl-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-ui-gtk-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-ui-sdl-debuginfo - update to 3.1.1.1-66.1
qemu-audio-pa-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-block-curl - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-guest-agent - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-audio-pa - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-debugsource - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-audio-alsa-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-block-iscsi - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-block-ssh - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-block-rbd-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-audio-oss-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-block-iscsi-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-s390 - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-s390-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-ppc-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-ppc - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-x86 - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-kvm - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-arm - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-arm-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-tools-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-tools - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-audio-alsa - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-lang - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-ui-gtk - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-ui-curses-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-ui-sdl - update to 3.1.1.1-66.1
qemu-block-ssh-debuginfo - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-ui-curses - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-audio-oss - addressed in versions 3.1.1.1-66.1, 3.1.1.1-150100.80.43.2
qemu-audio-sdl - update to 3.1.1.1-66.1
qemu-debuginfo - update to 3.1.1.1-150100.80.43.2
qemu-x86-debuginfo - update to 3.1.1.1-150100.80.43.2
qemu-sgabios - addressed in versions 8-66.1, 8-150100.80.43.2

• https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg01175.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1862167
• http://www.openwall.com/lists/oss-security/2021/03/09/1
• https://security.netapp.com/advisory/ntap-20210312-0003/
• https://lists.debian.org/debian-lts-announce/2021/04/msg00009.html

• Denial of service in QEMU SDHCI device emulation
• SUSE update for qemu
• SUSE update for qemu