CVE-2020-14364: Medium severity Qemu Qemu vulnerability
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setuplen' exceeds its 'databuf[4096]' in the dotokenin, dotokenout routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.
Other sources
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU. This issue occurs while processing USB packets from a guest when USBDevice 'setuplen' exceeds its 'databuf[4096]' in the dotokenin, dotokenout routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.
An out-of-bounds read/write access issue was found in the USB emulator of the QEMU. It occurs while processing USB packets from a guest, when USBDevice 'setuplen' exceeds the 'databuf[4096]' in dotokenin, dotokenout routines.
A guest user may use this flaw to crash the QEMU process resulting in DoS OR potentially execute arbitrary code with the privileges of the QEMU process on the host.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2020-08/msg05969.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 2:0.12.1.2-2.506.el6_10.8 - Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 2:0.12.1.2-2.415.el6_5.21 - Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 2:0.12.1.2-2.448.el6_6.9 - Upgrade
Upgrade
redhat/qemu-kvm-mato a version that resolves this vulnerability.Fixed in 10:2.12.0-48.el7_9.1 - Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 10:1.5.3-175.el7_9.1 - Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 10:1.5.3-105.el7_2.20 - Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 10:1.5.3-126.el7_3.18 - Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 10:1.5.3-141.el7_4.11 - Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 10:1.5.3-160.el7_6.8 - Upgrade
Upgrade
redhat/qemu-kvm-mato a version that resolves this vulnerability.Fixed in 10:2.12.0-18.el7_6.7 - Upgrade
Upgrade
redhat/qemu-kvm-mato a version that resolves this vulnerability.Fixed in 10:2.12.0-33.el7_7.4 - Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 10:1.5.3-167.el7_7.7 - Upgrade
Upgrade
redhat/qemu-kvm-rhevto a version that resolves this vulnerability.Fixed in 10:2.12.0-33.el7_7.12 - Upgrade
Upgrade
redhat/qemu-kvm-rhevto a version that resolves this vulnerability.Fixed in 10:2.12.0-48.el7_9.1 - Upgrade
Upgrade
redhat/qemu-kvm-rhevto a version that resolves this vulnerability.Fixed in 10:2.12.0-18.el7_6.12 - Upgrade
Upgrade
redhat/redhat-virtualization-hostto a version that resolves this vulnerability.Fixed in 0:4.3.11-20200922.0.el7_9 - Upgrade
Upgrade
redhat/redhat-virtualization-hostto a version that resolves this vulnerability.Fixed in 0:4.4.2-20200930.0.el8_2 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.1+dfsg-4Fixed in 1:3.1+dfsg-8+deb10u8 - Upgrade
Upgrade
redhat/QEMUto a version that resolves this vulnerability.Fixed in 5.2.0 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u2Fixed in 1:7.2+dfsg-7+deb12u12Fixed in 1:10.0.0~rc2+ds-2Fixed in 1:10.0.0~rc3+ds-2 - Upgrade
Upgrade
alpine/qemuto a version that resolves this vulnerability.Fixed in 5.0.0-r2 - Upgrade
Upgrade
alpine/qemuto a version that resolves this vulnerability.Fixed in 5.1.0-r1 - Upgrade
Upgrade
alpine/xento a version that resolves this vulnerability.Fixed in 4.12.3-r3 - Upgrade
Upgrade
alpine/xento a version that resolves this vulnerability.Fixed in 4.13.1-r3 - Upgrade
Upgrade
alpine/xento a version that resolves this vulnerability.Fixed in 4.13.1-r5 - Upgrade
Upgrade
alpine/xento a version that resolves this vulnerability.Fixed in 4.11.4-r1 - Upgrade
Upgrade
QEMUto a version that resolves this vulnerability.Fixed in 5.2.0 - Compensating control
Use the Libvirt management interface to manage guest virtual machines; Libvirt starts each guest process with an unprivileged system user and confines it with sVirt and SELinux policies.
Event History
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2020:4290
- RHSA-2020:4291
- RHSA-2020:4056
- RHSA-2020:4054
- RHSA-2020:4055
- RHSA-2020:4078
- RHSA-2020:4079
- RHSA-2020:4048
- RHSA-2020:4050
- RHSA-2020:4051
- RHSA-2020:4052
- RHSA-2020:4162
- RHSA-2020:4047
- RHSA-2020:4053
- RHSA-2020:4059
- RHSA-2020:4058
- RHSA-2020:4049
- RHSA-2020:4176
- RHSA-2020:4167
- RHSA-2020:4111
- RHSA-2020:4115
- RHSA-2020:4172
Frequently Asked Questions
What is CVE-2020-14364?
CVE-2020-14364 is an out-of-bounds read/write access flaw found in the USB emulator of the QEMU.
What is the severity of CVE-2020-14364?
CVE-2020-14364 has a severity level of high.
What software versions are affected by CVE-2020-14364?
QEMU versions before 5.2.0 are affected by CVE-2020-14364.
How can I fix CVE-2020-14364?
To fix CVE-2020-14364, update QEMU to version 5.2.0 or later.
Are there any references for CVE-2020-14364?
Yes, you can find more information about CVE-2020-14364 at the following references: [link1](https://lists.gnu.org/archive/html/qemu-devel/2020-08/msg05969.html) [link2](https://www.openwall.com/lists/oss-security/2020/08/24/3) [link3](https://www.openwall.com/lists/oss-security/2020/08/24/2)