CVE-2020-13765: Medium severity Qemu Qemu vulnerability
An out-of-bound write access flaw was found in the way QEMU loads ROM contents at boot time. This flaw occurs in the romcopy() routine while loading the contents of a 32-bit -kernel image into memory. Running an untrusted -kernel image may load contents at arbitrary memory locations, potentially leading to code execution with the privileges of the QEMU process.
Other sources
An out-of-bound write access issue was found in the way QEMU loads ROM contents at boot time. It occurs in romcopy() routine while loading contents of a 32-bit -kernel image into memory. Running an untrusted -kernel image may load contents at arbitrary memory locations, potentially leading to code execution with the privileges of the QEMU process.
Upstream patch: --------------- -> https://git.qemu.org/?p=qemu.git;a=commitdiff;h=e423455c4f23a1a828901c78fe6d03b7dde79319
Reference: ---------- -> https://bugs.launchpad.net/qemu/+bug/1844635 -> https://www.openwall.com/lists/oss-security/2020/06/03/6
— Red Hat
romcopy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-13765?
CVE-2020-13765 is a vulnerability that allows an out-of-bound write access in QEMU while loading ROM contents at boot time.
What is the severity of CVE-2020-13765?
CVE-2020-13765 has a severity rating of 5.6, which is considered medium.
Which software versions are affected by CVE-2020-13765?
QEMU versions 4.0 and 4.1.0 are affected by CVE-2020-13765.
How can I fix CVE-2020-13765?
To fix CVE-2020-13765, update QEMU to version 4.2.0.
Where can I find more information about CVE-2020-13765?
You can find more information about CVE-2020-13765 in the references provided: [link1], [link2], [link3].