CVE-2020-25723: Low severity Qemu Qemu vulnerability
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.
Other sources
A reachable assertion vulnerability was found in the USB EHCI emulation code of QEMU. This issue occurs while processing USB requests due to missed handling of DMA memory map failure. This flaw allows a malicious privileged user within the guest to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
A security issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests via ehciexecute() in hw/usb/hcd-ehci.c. More specifically, DMA memory map failure was not properly detected leading to reachable assertion (CWE-617) in a later call of addressspaceunmap() via usbpacketunmap(). This was fixed in the following commit by checking the return value of usbpacketmap(). A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.
Upstream fix: https://git.qemu.org/?p=qemu.git;a=commit;h=2fdb42d840400d58f2e706ecca82c142b97bcbd6
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/qemuto a version that resolves this vulnerability.Fixed in 5.2.0 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u2Fixed in 1:7.2+dfsg-7+deb12u7Fixed in 1:9.0.2+ds-2Fixed in 1:9.1.0+ds-2 - Upgrade
Upgrade
alpine/qemuto a version that resolves this vulnerability.Fixed in 5.2.0-r0 - Upgrade
Upgrade
QEMUto a version that resolves this vulnerability.Patch 2fdb42d840400d58f2e706ecca82c142b97bcbd6
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-25723?
CVE-2020-25723 has a severity rating that indicates it can lead to crashes of the QEMU process due to reachable assertion issues.
How do I fix CVE-2020-25723?
To fix CVE-2020-25723, upgrade QEMU to version 5.2.0 or apply the relevant patches provided by your Linux distribution.
Who is affected by CVE-2020-25723?
CVE-2020-25723 affects users running vulnerable versions of QEMU on systems like Debian and Red Hat.
What type of vulnerability is CVE-2020-25723?
CVE-2020-25723 is a reachable assertion issue related to USB EHCI emulation in QEMU.
Can a guest user exploit CVE-2020-25723?
Yes, a malicious privileged user within the guest can exploit CVE-2020-25723 by sending incorrect USB requests to crash the QEMU process.