CVE-2020-35505: Null Pointer Dereference
A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Other sources
A NULL pointer dereference issue was found in the am53c974 SCSI host bus adapter emulation of QEMU. It could occur in the dobusidcmd() function in hw/scsi/esp.c while handling the 'Information Transfer' command (CMDTI). A privileged guest user may abuse this issue to crash the QEMU process on the host, resulting in a denial of service condition.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/qemuto a version that resolves this vulnerability.Fixed in 6.0.0 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:7.2+dfsg-7+deb12u12Fixed in 1:9.2.2+ds-1Fixed in 1:10.0.0~rc1+ds-2 - Upgrade
Upgrade
alpine/qemuto a version that resolves this vulnerability.Fixed in 6.0.0-r2 - Upgrade
Upgrade
QEMUto a version that resolves this vulnerability.Fixed in 6.0.0
Event History
Frequently Asked Questions
What is CVE-2020-35505?
CVE-2020-35505 is a NULL pointer dereference flaw found in the am53c974 SCSI host bus adapter emulation of QEMU.
What is the severity of CVE-2020-35505?
CVE-2020-35505 has a severity rating of 4.4 (medium).
How does CVE-2020-35505 impact QEMU?
CVE-2020-35505 allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
Which versions of QEMU are affected by CVE-2020-35505?
Versions before 6.0.0 of QEMU are affected by CVE-2020-35505.
How can I mitigate CVE-2020-35505?
To mitigate CVE-2020-35505, update QEMU to version 6.0.0 or later.