CVE-2020-29129: Medium severity Libslirp Project Libslirp vulnerability
An out-of-bounds access issue was found in the SLiRP user networking implementation of QEMU. It could occur while processing ARP/NCSI packets, if the packet length was shorter than required to accommodate respective protocol headers and payload. A privileged guest user may use this flaw to potentially leak host information bytes.
Other sources
ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libslirpto a version that resolves this vulnerability.Fixed in 4.4.0-1+deb11u2Fixed in 4.7.0-1Fixed in 4.8.0-1 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u2Fixed in 1:7.2+dfsg-7+deb12u12Fixed in 1:10.0.0~rc3+ds-2 - Upgrade
Upgrade
alpine/libslirpto a version that resolves this vulnerability.Fixed in 4.4.0-r0
Event History
Frequently Asked Questions
What is CVE-2020-29129?
CVE-2020-29129 is an out-of-bounds access vulnerability found in the SLiRP user networking implementation of QEMU.
What is the severity of CVE-2020-29129?
CVE-2020-29129 has a low severity rating with a CVSS score of 2.5.
How does CVE-2020-29129 occur?
CVE-2020-29129 can occur while processing ARP/NCSI packets if the packet length is insufficient to accommodate the required headers and payload.
What is the potential impact of CVE-2020-29129?
CVE-2020-29129 could be used by a privileged guest user to potentially exploit the system.
Are there any references available for CVE-2020-29129?
Yes, here are some references for CVE-2020-29129: 1. https://lists.freedesktop.org/archives/slirp/2020-November/000115.html 2. https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1902232 3. https://www.openwall.com/lists/oss-security/2020/11/27/1