Vulnerability Details CVE-2020-13765
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 58.4%
CVSS Severity
CVSS v3 Score 5.6
CVSS v2 Score 6.8
References
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e423455c4f23a1a828901c78fe6d03b7dde79319
- https://github.com/qemu/qemu/commit/4f1c6cb2f9afafda05eab150fd2bd284edce6676
- https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html
- https://security.netapp.com/advisory/ntap-20200619-0006/
- https://usn.ubuntu.com/4467-1/
- https://www.openwall.com/lists/oss-security/2020/06/03/6
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e423455c4f23a1a828901c78fe6d03b7dde79319
- https://github.com/qemu/qemu/commit/4f1c6cb2f9afafda05eab150fd2bd284edce6676
- https://lists.debian.org/debian-lts-announce/2020/06/msg00032.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html
- https://security.netapp.com/advisory/ntap-20200619-0006/
- https://usn.ubuntu.com/4467-1/
- https://www.openwall.com/lists/oss-security/2020/06/03/6
Products affected by CVE-2020-13765
-
cpe:2.3:a:qemu:qemu:4.0.0
-
cpe:2.3:a:qemu:qemu:4.1.0
-
cpe:2.3:o:canonical:ubuntu_linux:16.04
-
cpe:2.3:o:canonical:ubuntu_linux:18.04
-
cpe:2.3:o:canonical:ubuntu_linux:20.04
-
cpe:2.3:o:debian:debian_linux:8.0
-
cpe:2.3:o:debian:debian_linux:9.0