CVE-2020-17380: Buffer Overflow
A heap-based buffer overflow vulnerability was found in QEMU in the SDHCI device emulation support. It could occur while doing a multi block SDMA transfer via sdhcisdmatransfermultiblocks() routine. A guest user or process could use this flaw to crash the QEMU process on the host resulting in a denial-of-service condition, or potentially execute arbitrary code with privileges of the QEMU process on the host.
Other sources
A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support. It could occur while doing a multi block SDMA transfer via the sdhcisdmatransfermultiblocks() routine in hw/sd/sdhci.c. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code with privileges of the QEMU process on the host.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-17380?
CVE-2020-17380 has been classified as a high severity vulnerability due to its potential to cause crashes in the QEMU process.
How do I fix CVE-2020-17380?
To fix CVE-2020-17380, update QEMU to a version that is not affected, specifically versions 1:5.2+dfsg-11+deb11u3, 1:9.0.2+ds-2 or later.
Who is affected by CVE-2020-17380?
CVE-2020-17380 affects users of QEMU, particularly those using versions prior to 5.0.0.
What impact does CVE-2020-17380 have on users?
CVE-2020-17380 can potentially lead to a denial of service by crashing the QEMU process when exploited.
What vulnerability type is CVE-2020-17380 categorized as?
CVE-2020-17380 is categorized as a heap-based buffer overflow vulnerability.