CVE-2020-14364medium
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.
References
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00024.html
https://bugzilla.redhat.com/show_bug.cgi?id=1869201
https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html
https://security.gentoo.org/glsa/202009-14
https://security.gentoo.org/glsa/202011-09
https://security.netapp.com/advisory/ntap-20200924-0006/
https://usn.ubuntu.com/4511-1/
https://www.debian.org/security/2020/dsa-4760
Details
Source: MITRE
Published: 2020-08-31
Updated: 2020-11-11
Type: CWE-787
Risk Information
CVSS v2
Base Score: 4.4
Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 3.4
Severity: MEDIUM
CVSS v3
Base Score: 5
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Impact Score: 3.7
Exploitability Score: 0.8
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
Configuration 2
OR
cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 151714 | openSUSE 15 Security Update : qemu (openSUSE-SU-2021:1942-1) | Nessus | SuSE Local Security Checks | medium |
| 151619 | openSUSE 15 Security Update : qemu (openSUSE-SU-2021:1043-1) | Nessus | SuSE Local Security Checks | medium |
| 151460 | F5 Networks BIG-IP : QEMU vulnerability (K09081535) | Nessus | F5 Networks Local Security Checks | medium |
| 151383 | EulerOS Virtualization 3.0.2.2 : qemu-kvm (EulerOS-SA-2021-2166) | Nessus | Huawei Local Security Checks | critical |
| 150736 | SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2021:1942-1) | Nessus | SuSE Local Security Checks | medium |
| 150733 | SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1947-1) | Nessus | SuSE Local Security Checks | medium |
| 150542 | SUSE SLES11 Security Update : xen (SUSE-SU-2020:14521-1) | Nessus | SuSE Local Security Checks | medium |
| 150537 | SUSE SLES11 Security Update : kvm (SUSE-SU-2021:14704-1) | Nessus | SuSE Local Security Checks | high |
| 150468 | SUSE SLES15 Security Update : qemu (SUSE-SU-2021:1918-1) | Nessus | SuSE Local Security Checks | high |
| 150414 | SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2021:1893-1) | Nessus | SuSE Local Security Checks | high |
| 150399 | SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1894-1) | Nessus | SuSE Local Security Checks | high |
| 150395 | SUSE SLES15 Security Update : qemu (SUSE-SU-2021:1895-1) | Nessus | SuSE Local Security Checks | high |
| 150220 | SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1837-1) | Nessus | SuSE Local Security Checks | medium |
| 150203 | SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1829-1) | Nessus | SuSE Local Security Checks | medium |
| 148966 | SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1305-1) | Nessus | SuSE Local Security Checks | high |
| 148761 | SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1241-1) | Nessus | SuSE Local Security Checks | high |
| 148758 | SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1240-1) | Nessus | SuSE Local Security Checks | high |
| 148757 | SUSE SLES15 Security Update : qemu (SUSE-SU-2021:1244-1) | Nessus | SuSE Local Security Checks | high |
| 148752 | SUSE SLES15 Security Update : qemu (SUSE-SU-2021:1245-1) | Nessus | SuSE Local Security Checks | high |
| 148632 | EulerOS Virtualization 2.9.0 : qemu (EulerOS-SA-2021-1763) | Nessus | Huawei Local Security Checks | medium |
| 148583 | EulerOS Virtualization 2.9.1 : qemu (EulerOS-SA-2021-1735) | Nessus | Huawei Local Security Checks | medium |
| 147490 | EulerOS Virtualization 3.0.6.6 : qemu (EulerOS-SA-2021-1455) | Nessus | Huawei Local Security Checks | medium |
| 147408 | NewStart CGSL MAIN 4.06 : qemu-kvm Multiple Vulnerabilities (NS-SA-2021-0004) | Nessus | NewStart CGSL Local Security Checks | medium |
| 146269 | Oracle Linux 7 : qemu (ELSA-2021-9034) | Nessus | Oracle Linux Local Security Checks | medium |
| 145837 | CentOS 8 : virt:rhel (CESA-2020:4059) | Nessus | CentOS Local Security Checks | medium |
| 144829 | EulerOS Virtualization 3.0.2.6 : qemu (EulerOS-SA-2021-1057) | Nessus | Huawei Local Security Checks | critical |
| 144525 | Virtuozzo 6 : qemu-guest-agent / qemu-img / qemu-kvm / etc (VZLSA-2020-4056) | Nessus | Virtuozzo Local Security Checks | medium |
| 143873 | SUSE SLES12 Security Update : xen (SUSE-SU-2020:2787-1) | Nessus | SuSE Local Security Checks | medium |
| 143853 | SUSE SLES12 Security Update : xen (SUSE-SU-2020:2788-1) | Nessus | SuSE Local Security Checks | medium |
| 143815 | SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2020:2877-1) | Nessus | SuSE Local Security Checks | medium |
| 143810 | SUSE SLES12 Security Update : qemu (SUSE-SU-2020:2743-1) | Nessus | SuSE Local Security Checks | medium |
| 143805 | SUSE SLES12 Security Update : xen (SUSE-SU-2020:2822-1) | Nessus | SuSE Local Security Checks | medium |
| 143685 | SUSE SLES12 Security Update : xen (SUSE-SU-2020:2786-1) | Nessus | SuSE Local Security Checks | medium |
| 143069 | RHEL 7 : qemu-kvm (RHSA-2020:4079) | Nessus | Red Hat Local Security Checks | medium |
| 143028 | RHEL 7 : qemu-kvm (RHSA-2020:4048) | Nessus | Red Hat Local Security Checks | medium |
| 143026 | RHEL 7 : qemu-kvm (RHSA-2020:4053) | Nessus | Red Hat Local Security Checks | medium |
| 143025 | RHEL 7 : qemu-kvm (RHSA-2020:4052) | Nessus | Red Hat Local Security Checks | medium |
| 143024 | RHEL 7 : qemu-kvm-ma (RHSA-2020:4047) | Nessus | Red Hat Local Security Checks | medium |
| 143014 | RHEL 7 : qemu-kvm (RHSA-2020:4050) | Nessus | Red Hat Local Security Checks | medium |
| 143007 | RHEL 6 : qemu-kvm (RHSA-2020:4054) | Nessus | Red Hat Local Security Checks | medium |
| 142974 | Amazon Linux AMI : qemu-img (ALAS-2020-1449) | Nessus | Amazon Linux Local Security Checks | high |
| 142843 | GLSA-202011-09 : QEMU: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | medium |
| 142726 | Amazon Linux 2 : ivshmem-tools (ALAS-2020-1562) | Nessus | Amazon Linux Local Security Checks | medium |
| 142647 | CentOS 6 : qemu-kvm (CESA-2020:4056) | Nessus | CentOS Local Security Checks | medium |
| 142608 | CentOS 7 : qemu-kvm (CESA-2020:4079) | Nessus | CentOS Local Security Checks | medium |
| 142284 | EulerOS 2.0 SP2 : qemu-kvm (EulerOS-SA-2020-2392) | Nessus | Huawei Local Security Checks | high |
| 141774 | RHEL 8 : virt:8.2 and virt-devel:8.2 (RHSA-2020:4291) | Nessus | Red Hat Local Security Checks | medium |
| 141767 | Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20201001) | Nessus | Scientific Linux Local Security Checks | medium |
| 141627 | RHEL 8 : virt:8.1 and virt-devel:8.1 (RHSA-2020:4290) | Nessus | Red Hat Local Security Checks | medium |
| 141409 | openSUSE Security Update : qemu (openSUSE-2020-1664) | Nessus | SuSE Local Security Checks | medium |
| 141313 | Oracle Linux 7 : qemu-kvm (ELSA-2020-4079) | Nessus | Oracle Linux Local Security Checks | medium |
| 141306 | RHEL 6 : qemu-kvm (RHSA-2020:4056) | Nessus | Red Hat Local Security Checks | medium |
| 141184 | RHEL 7 : qemu-kvm-rhev (RHSA-2020:4176) | Nessus | Red Hat Local Security Checks | medium |
| 141175 | RHEL 8 : Red Hat Virtualization (RHSA-2020:4172) | Nessus | Red Hat Local Security Checks | high |
| 141174 | RHEL 7 : qemu-kvm-rhev (RHSA-2020:4167) | Nessus | Red Hat Local Security Checks | medium |
| 141129 | RHEL 7 : qemu-kvm-ma (RHSA-2020:4162) | Nessus | Red Hat Local Security Checks | medium |
| 141128 | RHEL 8 : virt:rhel (RHSA-2020:4058) | Nessus | Red Hat Local Security Checks | medium |
| 141120 | Oracle Linux 8 : virt:ol (ELSA-2020-4059) | Nessus | Oracle Linux Local Security Checks | medium |
| 141087 | RHEL 7 : redhat-release-virtualization-host and redhat-virtualization-host (RHSA-2020:4115) | Nessus | Red Hat Local Security Checks | high |
| 141064 | GLSA-202009-14 : Xen: Buffer overflow | Nessus | Gentoo Local Security Checks | medium |
| 141053 | Oracle Linux 6 : qemu-kvm (ELSA-2020-4056) | Nessus | Oracle Linux Local Security Checks | medium |
| 141049 | RHEL 7 : qemu-kvm-ma (RHSA-2020:4078) | Nessus | Red Hat Local Security Checks | medium |
| 141046 | RHEL 8 : virt:rhel (RHSA-2020:4059) | Nessus | Red Hat Local Security Checks | medium |
| 141045 | RHEL 8 : virt:rhel (RHSA-2020:4049) | Nessus | Red Hat Local Security Checks | medium |
| 141034 | RHEL 6 : qemu-kvm (RHSA-2020:4055) | Nessus | Red Hat Local Security Checks | medium |
| 141011 | RHEL 7 : qemu-kvm (RHSA-2020:4051) | Nessus | Red Hat Local Security Checks | medium |
| 141005 | EulerOS 2.0 SP8 : qemu (EulerOS-SA-2020-2157) | Nessus | Huawei Local Security Checks | medium |
| 140864 | EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2020-2097) | Nessus | Huawei Local Security Checks | high |
| 140637 | Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU vulnerability (USN-4511-1) | Nessus | Ubuntu Local Security Checks | medium |
| 140541 | Debian DLA-2373-1 : qemu security update | Nessus | Debian Local Security Checks | medium |
| 140506 | Fedora 31 : xen (2020-3689b67b53) | Nessus | Fedora Local Security Checks | medium |
| 140317 | EulerOS Virtualization for ARM 64 3.0.2.0 : qemu-kvm (EulerOS-SA-2020-1947) | Nessus | Huawei Local Security Checks | medium |
| 140301 | Debian DSA-4760-1 : qemu - security update | Nessus | Debian Local Security Checks | medium |
| 140019 | OracleVM 3.4 : xen (OVMSA-2020-0039) (Bunker Buster) (Foreshadow) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Meltdown) (POODLE) (Spectre) | Nessus | OracleVM Local Security Checks | critical |
| 140018 | OracleVM 3.4 : xen (OVMSA-2020-0038) | Nessus | OracleVM Local Security Checks | medium |
| 140017 | EulerOS Virtualization for ARM 64 3.0.6.0 : qemu-kvm (EulerOS-SA-2020-1914) | Nessus | Huawei Local Security Checks | medium |