CVE-2020-13754: Buffer Overflow
An OOB access issue was found in the Message Signalled Interrupt (MSI-X) device support of QEMU. It could occur while performing MSI-X mmio operations when a guest sent address goes beyond the mmio region. A guest user/process may use this flaw to crash the QEMU process resulting in DoS scenario.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg03732.html
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2020/06/01/6
Other sources
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/QEMUto a version that resolves this vulnerability.Fixed in 5.0.1 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u4Fixed in 1:7.2+dfsg-7+deb12u13Fixed in 1:10.0.0+ds-2
Event History
Frequently Asked Questions
What is CVE-2020-13754?
CVE-2020-13754 is a vulnerability in QEMU 4.2.0 that allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.
How do I know if I am affected by CVE-2020-13754?
You are affected by CVE-2020-13754 if you are using QEMU 4.2.0.
What is the severity of CVE-2020-13754?
The severity of CVE-2020-13754 is medium (6.7).
How do I fix CVE-2020-13754 in Red Hat?
To fix CVE-2020-13754 in Red Hat, you need to update QEMU to version 5.0.1.
How do I fix CVE-2020-13754 in Ubuntu?
To fix CVE-2020-13754 in Ubuntu, you need to update QEMU to the specified versions: 1:2.5+dfsg-5ubuntu10.45 for Xenial, 1:2.11+dfsg-1ubuntu7.31 for Bionic, and 1:4.2-3ubuntu6.4 for Focal.
How do I fix CVE-2020-13754 in Debian?
To fix CVE-2020-13754 in Debian, you need to update QEMU to the specified versions: 1:3.1+dfsg-8+deb10u8, 1:3.1+dfsg-8+deb10u11, 1:5.2+dfsg-11+deb11u3, 1:5.2+dfsg-11+deb11u2, 1:7.2+dfsg-7+deb12u2, or 1:8.1.2+ds-1.