CVE-2020-1711: High severity Qemu Qemu vulnerability
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsicoblockstatus() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.
Other sources
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsicoblockstatus() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.
An out-of-bounds heap buffer access issue was found in the way iSCSI Block driver in QEMU handled response coming from an iSCSI server, while checking status of a Logical Address Block (LBA) in iscsicoblockstatus() routine.
A remote user could use this flaw to crash the QEMU process resulting in DoS OR potentially execute arbitrary code with privileges of the QEMU process on the host.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2020-01/msg05535.html
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2020/01/23/3
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/qemu-kvm-mato a version that resolves this vulnerability.Fixed in 10:2.12.0-44.el7 - Upgrade
Upgrade
redhat/qemu-kvm-mato a version that resolves this vulnerability.Fixed in 10:2.10.0-21.el7_5.5 - Upgrade
Upgrade
redhat/qemu-kvm-mato a version that resolves this vulnerability.Fixed in 10:2.12.0-18.el7_6.5 - Upgrade
Upgrade
redhat/qemu-kvm-mato a version that resolves this vulnerability.Fixed in 10:2.12.0-33.el7_7.3 - Upgrade
Upgrade
redhat/qemu-kvm-rhevto a version that resolves this vulnerability.Fixed in 10:2.12.0-33.el7_7.10 - Upgrade
Upgrade
redhat/qemu-kvm-rhevto a version that resolves this vulnerability.Fixed in 10:2.12.0-44.el7 - Upgrade
Upgrade
redhat/qemu-kvm-rhevto a version that resolves this vulnerability.Fixed in 10:2.12.0-18.el7_6.9 - Upgrade
Upgrade
redhat/QEMUto a version that resolves this vulnerability.Fixed in 4.2.1 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u5Fixed in 1:7.2+dfsg-7+deb12u18Fixed in 1:7.2+dfsg-7+deb12u15Fixed in 1:10.0.11+ds-0+deb13u1Fixed in 1:10.0.2+ds-2+deb13u1Fixed in 1:11.0.2+ds-2 - Upgrade
Upgrade
QEMU iSCSI Block driverto a version that resolves this vulnerability.Fixed in 4.2.1 - Upgrade
Upgrade
QEMU iSCSI Block driverto a version that resolves this vulnerability.Fixed in 2.12.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this flaw?
The vulnerability ID for this flaw is CVE-2020-1711.
What is the severity of CVE-2020-1711?
The severity of CVE-2020-1711 is high.
What software is affected by CVE-2020-1711?
QEMU versions 2.12.0 before 4.2.1 and qemu-kvm-ma versions 10:2.12.0-44.el7, 10:2.10.0-21.el7_5.5, 10:2.12.0-18.el7_6.5, 10:2.12.0-33.el7_7.3, 10:2.12.0-33.el7_7, 10:2.12.0-33.el7_7.10, 10:2.12.0-44.el7, 10:2.12.0-18.el7_6.9 are affected.
What is the fix for CVE-2020-1711?
The fix for CVE-2020-1711 is to update QEMU to version 4.2.1 or later.
Are there any references for more information about CVE-2020-1711?
Yes, you can find more information about CVE-2020-1711 at the following references: [Link 1](https://lists.gnu.org/archive/html/qemu-devel/2020-01/msg05535.html), [Link 2](https://www.openwall.com/lists/oss-security/2020/01/23/3), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1794494).