CVE-2020-15469
In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
- Обновитесь до 1:4.2-3ubuntu6.17
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости qemu · Страница 4
За последние 30 дней в qemu опубликовано уязвимостей: 0; в каталоге KEV: 0.
Уязвимостей: 75
CVE-2020-10761
An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server resulting in a denial of service.
- Обновитесь до 1:4.2-3ubuntu6.4
Опубликовано ОбновленоCVE-2020-10702
A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU.
- Обновитесь до 1:4.2-3ubuntu5
Опубликовано ОбновленоCVE-2020-13800
ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call.
- Обновитесь до 1:4.2-3ubuntu6.4
Опубликовано ОбновленоCVE-2020-13754
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.
- Обновитесь до 1:4.2-3ubuntu6.4
Опубликовано ОбновленоCVE-2020-13659
address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
- Обновитесь до 1:4.2-3ubuntu6.4
Опубликовано ОбновленоCVE-2020-13362
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.
- Обновитесь до 1:4.2-3ubuntu6.4
Опубликовано ОбновленоCVE-2020-13361
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
- Обновитесь до 1:4.2-3ubuntu6.4
Опубликовано ОбновленоCVE-2020-13253
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.
- Обновитесь до 1:4.2-3ubuntu6.4
Опубликовано ОбновленоCVE-2020-11869
An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati-2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.
- Обновитесь до 1:4.2-3ubuntu6.1
Опубликовано ОбновленоCVE-2020-1711
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.
- Обновитесь до 1:4.2-3ubuntu1
Опубликовано ОбновленоCVE-2019-12068
In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.
- Обновитесь до 1:4.2-1ubuntu1
Опубликовано ОбновленоCVE-2019-15890
libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.
- Обновитесь до 1:4.2-1ubuntu1
Опубликовано ОбновленоCVE-2019-14378
ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.
- Обновитесь до 1:4.2-1ubuntu1
Опубликовано ОбновленоCVE-2019-12155
interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
- Обновитесь до 1:4.2-1ubuntu1
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.