CVE-2020-1983: libslirp: use after free vulnerability cause a denial of service.
A use after free vulnerability in ipreass() in ipinput.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
Other sources
A use-after-free flaw was found in the SLiRP networking implementation of the QEMU emulator. Specifically, this flaw occurs in the ipreass() routine while reassembling incoming IP fragments whose combined size is bigger than 65k. This flaw allows an attacker to crash the QEMU process on the host, resulting in a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 10:1.5.3-175.el7_9.1 - Upgrade
Upgrade
redhat/qemu-kvm-mato a version that resolves this vulnerability.Fixed in 10:2.12.0-48.el7_9.2 - Upgrade
Upgrade
redhat/qemu-kvm-rhevto a version that resolves this vulnerability.Fixed in 10:2.12.0-48.el7_9.2 - Upgrade
Upgrade
redhat/libslirpto a version that resolves this vulnerability.Fixed in 4.3.0 - Upgrade
Upgrade
debian/libslirpto a version that resolves this vulnerability.Fixed in 4.4.0-1+deb11u2Fixed in 4.7.0-1Fixed in 4.8.0-1Fixed in 4.9.1-1 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u5Fixed in 1:7.2+dfsg-7+deb12u18Fixed in 1:7.2+dfsg-7+deb12u15Fixed in 1:10.0.7+ds-0+deb13u1Fixed in 1:10.0.2+ds-2+deb13u1Fixed in 1:10.2.1+ds-1 - Upgrade
Upgrade
debian/slirp4netnsto a version that resolves this vulnerability.Fixed in 1.0.1-2Fixed in 1.2.0-1Fixed in 1.2.1-1.1Fixed in 1.3.3-1 - Upgrade
Upgrade
alpine/libslirpto a version that resolves this vulnerability.Fixed in 4.3.0-r0 - Upgrade
Upgrade
libslirpto a version that resolves this vulnerability.Patch 9ac0371bb8c0a40f5d9f82a1c25129660e81df04
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-1983?
CVE-2020-1983 is a use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases.
What is the severity of CVE-2020-1983?
The severity of CVE-2020-1983 is high, with a CVSS score of 6.5.
How does CVE-2020-1983 affect the QEMU emulator?
CVE-2020-1983 can cause the QEMU process on the host to crash.
How can I fix CVE-2020-1983?
To fix CVE-2020-1983, update to libslirp version 4.3.0 or later.
Where can I find more information about CVE-2020-1983?
You can find more information about CVE-2020-1983 at the following references: [link1], [link2], [link3].