CVE-2020-25624: Medium severity Qemu Qemu vulnerability
hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u2Fixed in 1:7.2+dfsg-7+deb12u7Fixed in 1:9.0.2+ds-2Fixed in 1:9.1.0+ds-3 - Upgrade
Upgrade
alpine/qemuto a version that resolves this vulnerability.Fixed in 5.1.0-r1
Event History
Frequently Asked Questions
What is the severity of CVE-2020-25624?
CVE-2020-25624 has been classified as a moderate severity vulnerability, due to the potential for stack-based buffer over-read.
How do I fix CVE-2020-25624?
To mitigate CVE-2020-25624, upgrade QEMU to a version that is not affected, such as those listed in the remediation section.
What type of vulnerability is CVE-2020-25624?
CVE-2020-25624 is a stack-based buffer over-read vulnerability found in the QEMU USB host controller driver.
Which versions of QEMU are affected by CVE-2020-25624?
CVE-2020-25624 affects QEMU version 5.0.0 and potentially earlier versions.
Does CVE-2020-25624 affect all operating systems?
CVE-2020-25624 specifically affects QEMU running on Debian GNU/Linux 10.0 and associated packages.