Infinite loop in QEMU - CVE-2020-14394

Vulnerability identifier: #VU73788

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-14394

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. A privileged user on the guest OS can consume all available system resources and cause denial of service conditions of the QEMU process on the host.

QEMU
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP3 LTSS
Server Applications Module
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Fedora
qemu-ipxe
qemu-vgabios
qemu-seabios
qemu-arm
qemu-tools
qemu-block-iscsi-debuginfo
qemu-tools-debuginfo
qemu-arm-debuginfo
qemu-audio-alsa
qemu-kvm
qemu-x86
qemu-ppc
qemu-ppc-debuginfo
qemu-s390-debuginfo
qemu-s390
qemu-audio-sdl
qemu-audio-alsa-debuginfo
qemu-block-ssh-debuginfo
qemu-audio-oss
qemu-audio-oss-debuginfo
qemu-block-rbd-debuginfo
qemu-block-ssh
qemu-block-iscsi
qemu-lang
qemu-debugsource
qemu-audio-sdl-debuginfo
qemu-guest-agent
qemu-block-curl
qemu-audio-pa-debuginfo
qemu-ui-gtk-debuginfo
qemu-ui-gtk
qemu-ui-curses-debuginfo
qemu-ui-sdl
qemu-audio-pa
qemu-ui-curses
qemu-ui-sdl-debuginfo
qemu-block-curl-debuginfo
qemu-guest-agent-debuginfo
qemu-block-rbd
qemu
qemu-img
qemu-debuginfo
qemu-help
qemu-system-mips (Ubuntu package)
qemu (Ubuntu package)
qemu-system-x86-xen (Ubuntu package)
qemu-system-x86 (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu-system-misc (Ubuntu package)
qemu-system (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-system-x86-microvm (Ubuntu package)
qemu-s390x
qemu-s390x-debuginfo
qemu-hw-s390x-virtio-gpu-ccw
qemu-hw-s390x-virtio-gpu-ccw-debuginfo
qemu-SLOF
qemu-skiboot
qemu-hw-display-virtio-gpu-pci-debuginfo
qemu-ui-spice-core
qemu-ui-opengl
qemu-ui-spice-app-debuginfo
qemu-chardev-spice-debuginfo
qemu-chardev-baum-debuginfo
qemu-chardev-baum
qemu-hw-display-virtio-gpu
qemu-hw-display-virtio-vga
qemu-hw-display-qxl
qemu-hw-usb-redirect
qemu-hw-usb-redirect-debuginfo
qemu-ui-spice-app
qemu-ksm
qemu-hw-display-virtio-gpu-pci
qemu-x86-debuginfo
qemu-hw-display-virtio-gpu-debuginfo
qemu-ui-spice-core-debuginfo
qemu-hw-display-virtio-vga-debuginfo
qemu-audio-spice-debuginfo
qemu-chardev-spice
qemu-hw-display-qxl-debuginfo
qemu-audio-spice
qemu-ui-opengl-debuginfo
qemu-linux-user-debuginfo
qemu-testsuite
qemu-linux-user-debugsource
qemu-linux-user
qemu-audio-jack
qemu-extra
qemu-vhost-user-gpu-debuginfo
qemu-block-nfs-debuginfo
qemu-vhost-user-gpu
qemu-accel-tcg-x86
qemu-accel-tcg-x86-debuginfo
qemu-hw-usb-host
qemu-extra-debuginfo
qemu-block-dmg-debuginfo
qemu-block-nfs
qemu-hw-usb-smartcard
qemu-ivshmem-tools-debuginfo
qemu-microvm
qemu-accel-qtest-debuginfo
qemu-hw-usb-smartcard-debuginfo
qemu-hw-usb-host-debuginfo
qemu-ivshmem-tools
qemu-block-dmg
qemu-accel-qtest
qemu-block-gluster
qemu-audio-jack-debuginfo
qemu-block-gluster-debuginfo
qemu-system-xen (Ubuntu package)
app-emulation/qemu
qemu-sgabios

Install updates from vendor's website.

qemu-ipxe - addressed in versions 1.0.0+-66.1, 1.0.0+-150300.121.2, 1.0.0+-150400.37.14.2
qemu-vgabios - addressed in versions 1.12.0_0_ga698c89-66.1, 1.14.0_0_g155821a-150300.121.2, 1.15.0_0_g2dd4b9b-150400.37.14.2
qemu-seabios - addressed in versions 1.12.0_0_ga698c89-66.1, 1.14.0_0_g155821a-150300.121.2, 1.15.0_0_g2dd4b9b-150400.37.14.2
qemu-arm - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-tools - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-block-iscsi-debuginfo - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-tools-debuginfo - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-arm-debuginfo - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-audio-alsa - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-kvm - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-x86 - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ppc - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ppc-debuginfo - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-s390-debuginfo - update to 3.1.1.1-66.1
qemu-s390 - update to 3.1.1.1-66.1
qemu-audio-sdl - update to 3.1.1.1-66.1
qemu-audio-alsa-debuginfo - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-block-ssh-debuginfo - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-audio-oss - update to 3.1.1.1-66.1
qemu-audio-oss-debuginfo - addressed in versions 3.1.1.1-66.1, 6.2.0-150400.37.14.2
qemu-block-rbd-debuginfo - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-block-ssh - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-block-iscsi - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-lang - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-debugsource - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-audio-sdl-debuginfo - update to 3.1.1.1-66.1
qemu-guest-agent - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-block-curl - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-audio-pa-debuginfo - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ui-gtk-debuginfo - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ui-gtk - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ui-curses-debuginfo - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ui-sdl - update to 3.1.1.1-66.1
qemu-audio-pa - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ui-curses - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ui-sdl-debuginfo - update to 3.1.1.1-66.1
qemu-block-curl-debuginfo - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-guest-agent-debuginfo - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-block-rbd - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu - addressed in versions 3.1.1.1-66.1, 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-img - update to 4.1.0-70
qemu-debuginfo - update to 4.1.0-70
qemu - update to 4.1.0-70
qemu-block-rbd - update to 4.1.0-70
qemu-block-ssh - update to 4.1.0-70
qemu-guest-agent - update to 4.1.0-70
qemu-debugsource - update to 4.1.0-70
qemu-block-iscsi - update to 4.1.0-70
qemu-block-curl - update to 4.1.0-70
qemu-help - update to 4.1.0-70
qemu-seabios - update to 4.1.0-70
qemu-system-mips (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:6.2+dfsg-2ubuntu6.16
qemu-system-x86-xen (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-x86 (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-sparc (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-s390x (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-ppc (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-misc (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-arm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21, 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
qemu-system-x86-microvm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.28, 1:4.2-3ubuntu6.29, 1:6.2+dfsg-2ubuntu6.16, 1:6.2+dfsg-2ubuntu6.21
qemu-s390x - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-s390x-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-hw-s390x-virtio-gpu-ccw - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-hw-s390x-virtio-gpu-ccw-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-SLOF - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-skiboot - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-hw-display-virtio-gpu-pci-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ui-spice-core - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ui-opengl - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ui-spice-app-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-chardev-spice-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-chardev-baum-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-chardev-baum - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-hw-display-virtio-gpu - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-hw-display-virtio-vga - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-hw-display-qxl - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-hw-usb-redirect - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-hw-usb-redirect-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ui-spice-app - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ksm - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-hw-display-virtio-gpu-pci - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-x86-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-hw-display-virtio-gpu-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ui-spice-core-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-hw-display-virtio-vga-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-audio-spice-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-chardev-spice - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-hw-display-qxl-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-audio-spice - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-ui-opengl-debuginfo - addressed in versions 5.2.0-150300.121.2, 6.2.0-150400.37.14.2
qemu-linux-user-debuginfo - update to 6.2.0-150400.37.14.1
qemu-testsuite - update to 6.2.0-150400.37.14.1
qemu-linux-user-debugsource - update to 6.2.0-150400.37.14.1
qemu-linux-user - update to 6.2.0-150400.37.14.1
qemu-audio-jack - update to 6.2.0-150400.37.14.2
qemu-extra - update to 6.2.0-150400.37.14.2
qemu-vhost-user-gpu-debuginfo - update to 6.2.0-150400.37.14.2
qemu-block-nfs-debuginfo - update to 6.2.0-150400.37.14.2
qemu-vhost-user-gpu - update to 6.2.0-150400.37.14.2
qemu-accel-tcg-x86 - update to 6.2.0-150400.37.14.2
qemu-accel-tcg-x86-debuginfo - update to 6.2.0-150400.37.14.2
qemu-hw-usb-host - update to 6.2.0-150400.37.14.2
qemu-extra-debuginfo - update to 6.2.0-150400.37.14.2
qemu-block-dmg-debuginfo - update to 6.2.0-150400.37.14.2
qemu-block-nfs - update to 6.2.0-150400.37.14.2
qemu-hw-usb-smartcard - update to 6.2.0-150400.37.14.2
qemu-ivshmem-tools-debuginfo - update to 6.2.0-150400.37.14.2
qemu-microvm - update to 6.2.0-150400.37.14.2
qemu-accel-qtest-debuginfo - update to 6.2.0-150400.37.14.2
qemu-hw-usb-smartcard-debuginfo - update to 6.2.0-150400.37.14.2
qemu-hw-usb-host-debuginfo - update to 6.2.0-150400.37.14.2
qemu-ivshmem-tools - update to 6.2.0-150400.37.14.2
qemu-block-dmg - update to 6.2.0-150400.37.14.2
qemu-accel-qtest - update to 6.2.0-150400.37.14.2
qemu-block-gluster - update to 6.2.0-150400.37.14.2
qemu-audio-jack-debuginfo - update to 6.2.0-150400.37.14.2
qemu-block-gluster-debuginfo - update to 6.2.0-150400.37.14.2
qemu - update to 7.0.0-12.fc37
qemu-system-xen (Ubuntu package) - addressed in versions 1:7.2+dfsg-5ubuntu2.4, 1:8.0.4+dfsg-1ubuntu3.23.10.2
app-emulation/qemu - update to 8.0.0
qemu-sgabios - addressed in versions 8-66.1, 8-150300.121.2, 8-150400.37.14.2

• https://bugzilla.redhat.com/show_bug.cgi?id=1908004
• https://gitlab.com/qemu-project/qemu/-/issues/646
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I7J5IRXJYLELW7D43A75LOWRUE5EU54O/
• https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html

• Denial of service in QEMU
• SUSE update for qemu
• SUSE update for qemu
• SUSE update for qemu
• SUSE update for qemu
• Ubuntu update for qemu
• openEuler update for qemu
• Ubuntu update for qemu
• Gentoo update for QEMU
• Fedora 37 update for qemu