CVE-2020-15469: Null Pointer Dereference
In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:7.2+dfsg-7+deb12u12Fixed in 1:10.0.0~rc2+ds-2Fixed in 1:10.0.0~rc3+ds-2 - Upgrade
Upgrade
alpine/qemuto a version that resolves this vulnerability.Fixed in 5.0.0-r0
Event History
Frequently Asked Questions
What is CVE-2020-15469?
CVE-2020-15469 is a vulnerability in QEMU 4.2.0 that could lead to a NULL pointer dereference due to a lack of read/write callback methods in a MemoryRegionOps object.
How severe is CVE-2020-15469?
CVE-2020-15469 has a severity level of 2.3, which is considered low.
What software versions are affected by CVE-2020-15469?
QEMU versions up to 5.0.1, Debian Linux 9.0, and Debian Linux 10.0 are affected by CVE-2020-15469.
How can I fix CVE-2020-15469?
To fix CVE-2020-15469, update QEMU to a version that includes the necessary read/write callback methods and apply any available patches or updates for your specific distribution.
Where can I find more information about CVE-2020-15469?
You can find more information about CVE-2020-15469 on the Openwall and QEMU mailing lists, as well as the Debian LTS announcement.