CVE-2020-12829: Integer Overflow
An out-of-bounds read/write vulnerability was found in function Sm5012doperation() in hw/display/sm501.c. The OOB flaw is caused by an integer overflow in COPYAREA when the rtl parameter is set to 1, and either srcy or srcx is less than operationheight. Please refer to the following duplicate bug for further details: https://bugzilla.redhat.com/showbug.cgi?id=1786026.
Upstream fix: https://git.qemu.org/?p=qemu.git;a=commit;h=b15a22bbcbe6a78dc3d88fe3134985e4cdd87de4
Other sources
In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPYAREA macro while handling MMIO write operations through the sm5012denginewrite() callback. A local attacker could abuse this flaw to crash the QEMU process in sm5012doperation() in hw/display/sm501.c on the host, resulting in a denial of service.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-12829?
CVE-2020-12829 is a vulnerability in the SM501 display driver implementation in QEMU.
What is the severity of CVE-2020-12829?
The severity of CVE-2020-12829 is low with a CVSS score of 3.8.
Which software versions are affected by CVE-2020-12829?
QEMU versions up to 5.0.0 are affected by CVE-2020-12829.
How can a local attacker abuse CVE-2020-12829?
A local attacker can abuse CVE-2020-12829 to crash the QEMU process.
Where can I find more information about CVE-2020-12829?
More information about CVE-2020-12829 can be found at the following references: [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1808510), [Ubuntu USN](https://usn.ubuntu.com/4467-1/), [Debian DSA](https://www.debian.org/security/2020/dsa-4760).