CVE-2020-25723: Low severity qemu vulnerability
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.
Other sources
A reachable assertion vulnerability was found in the USB EHCI emulation code of QEMU. This issue occurs while processing USB requests due to missed handling of DMA memory map failure. This flaw allows a malicious privileged user within the guest to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
A security issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests via ehciexecute() in hw/usb/hcd-ehci.c. More specifically, DMA memory map failure was not properly detected leading to reachable assertion (CWE-617) in a later call of addressspaceunmap() via usbpacketunmap(). This was fixed in the following commit by checking the return value of usbpacketmap(). A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.
Upstream fix: https://git.qemu.org/?p=qemu.git;a=commit;h=2fdb42d840400d58f2e706ecca82c142b97bcbd6
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-25723?
CVE-2020-25723 has a severity rating that indicates it can lead to crashes of the QEMU process due to reachable assertion issues.
How do I fix CVE-2020-25723?
To fix CVE-2020-25723, upgrade QEMU to version 5.2.0 or apply the relevant patches provided by your Linux distribution.
Who is affected by CVE-2020-25723?
CVE-2020-25723 affects users running vulnerable versions of QEMU on systems like Debian and Red Hat.
What type of vulnerability is CVE-2020-25723?
CVE-2020-25723 is a reachable assertion issue related to USB EHCI emulation in QEMU.
Can a guest user exploit CVE-2020-25723?
Yes, a malicious privileged user within the guest can exploit CVE-2020-25723 by sending incorrect USB requests to crash the QEMU process.