CVE-2020-25743: Null Pointer Dereference
A null pointer dereference issue was found in the IDE disk emulator of QEMU. It could occur while cancelling an i/o operation via idecanceldmasync() routine, if a block drive pointer is null. A guest may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
Upstream patch: --------------- -> https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg01568.html
Other sources
hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an idecanceldmasync call.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-25743?
CVE-2020-25743 is a vulnerability in QEMU before 5.1.1 that can trigger a NULL pointer dereference.
How does CVE-2020-25743 occur?
CVE-2020-25743 occurs because of a lack of pointer check before an ide_cancel_dma_sync call in QEMU.
What is the severity of CVE-2020-25743?
The severity of CVE-2020-25743 is low with a severity value of 3.2.
Which software versions are affected by CVE-2020-25743?
QEMU versions before 5.1.1 are affected by CVE-2020-25743.
Where can I find more information about CVE-2020-25743?
More information about CVE-2020-25743 can be found at the following references: [1], [2], [3].