CVE-2020-14394: Low severity qemu vulnerability
An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.
Other sources
An infinite loop issue was found in the USB xHCI controller emulation of QEMU. Specifically, function xhciringchainlength() in hw/usb/hcd-xhci.c may get stuck while fetching TRBs from guest memory, since the exit conditions of the loop depend on values that are fully controlled by guest. A privileged guest user may exploit this issue to hang the QEMU process on the host, resulting in a denial of service.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-14394?
CVE-2020-14394 is an infinite loop flaw in the USB xHCI controller emulation of QEMU.
How does CVE-2020-14394 impact the QEMU process?
CVE-2020-14394 allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.
Which software versions are affected by CVE-2020-14394?
QEMU versions up to and excluding 7.1.0 are affected by CVE-2020-14394.
What is the severity of CVE-2020-14394?
The severity of CVE-2020-14394 is low, with a CVSS score of 3.2.
How can I fix CVE-2020-14394?
To fix CVE-2020-14394, update your QEMU installation to version 7.1.0 or later.