CVE-2020-7039: Buffer Overflow

Published Jan 7, 2020
·
Updated

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. It occurs in tcpemu() routine while emulating IRC and other protocols.

A user/process could use this flaw to crash the Qemu process on the host resulting in DoS or potentially execute arbitrary code with privileges of the QEMU process.

Upstream patch(es): ------------------- -> https://gitlab.freedesktop.org/slirp/libslirp/commit/2655fffed7a9e765bcb4701dd876e9dab975f289 -> https://gitlab.freedesktop.org/slirp/libslirp/commit/ce131029d6d4a405cb7d3ac6716d03e58fb4a5d9 -> https://gitlab.freedesktop.org/slirp/libslirp/commit/82ebe9c370a0e2970fb5695aa19aa5214a6a1c80

Reference: ---------- -> https://www.openwall.com/lists/oss-security/2020/01/16/2

Other sources

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the tcpemu() routine while emulating IRC and other protocols. An attacker could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process.

tcpemu in tcpsubr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMUIRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.

Affected Software

20 affected componentsFixes available
redhat/qemu-kvm<2:0.12.1.2-2.506.el6_10.6
2:0.12.1.2-2.506.el6_10.6
redhat/qemu-kvm<10:1.5.3-173.el7
10:1.5.3-173.el7
redhat/qemu-kvm-ma<10:2.12.0-44.el7
10:2.12.0-44.el7
redhat/qemu-kvm<10:1.5.3-167.el7_7.6
10:1.5.3-167.el7_7.6
redhat/qemu-kvm-ma<10:2.12.0-33.el7_7.3
10:2.12.0-33.el7_7.3
redhat/slirp4netns<0:0.3.0-8.el7_7
0:0.3.0-8.el7_7
redhat/slirp4netns<0:0.4.2-3.git21fdece.el8
0:0.4.2-3.git21fdece.el8
redhat/qemu-kvm-rhev<10:2.12.0-33.el7_7.10
10:2.12.0-33.el7_7.10
redhat/qemu-kvm-rhev<10:2.12.0-44.el7
10:2.12.0-44.el7
redhat/qemu-kvm-rhev<10:2.12.0-44.el7_8.1
10:2.12.0-44.el7_8.1
redhat/qemu-kvm-rhev<10:2.12.0-18.el7_6.11
10:2.12.0-18.el7_6.11
redhat/libslirp<4.2.0
4.2.0
Libslirp Project Libslirp=4.1.0
Qemu Qemu=4.2.0
Debian Debian Linux=8.0
Debian Debian Linux=9.0
openSUSE Leap=15.1
debian/libslirp
4.4.0-1+deb11u24.7.0-14.8.0-1+deb13u14.9.3-1
debian/qemu
1:5.2+dfsg-11+deb11u31:5.2+dfsg-11+deb11u51:7.2+dfsg-7+deb12u181:7.2+dfsg-7+deb12u151:10.0.11+ds-0+deb13u11:10.0.2+ds-2+deb13u11:11.0.2+ds-2
debian/slirp
1:1.0.17-111:1.0.17-12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/qemu-kvm to a version that resolves this vulnerability.

    Fixed in 2:0.12.1.2-2.506.el6_10.6
  2. Upgrade

    Upgrade redhat/qemu-kvm to a version that resolves this vulnerability.

    Fixed in 10:1.5.3-173.el7
  3. Upgrade

    Upgrade redhat/qemu-kvm-ma to a version that resolves this vulnerability.

    Fixed in 10:2.12.0-44.el7
  4. Upgrade

    Upgrade redhat/qemu-kvm to a version that resolves this vulnerability.

    Fixed in 10:1.5.3-167.el7_7.6
  5. Upgrade

    Upgrade redhat/qemu-kvm-ma to a version that resolves this vulnerability.

    Fixed in 10:2.12.0-33.el7_7.3
  6. Upgrade

    Upgrade redhat/slirp4netns to a version that resolves this vulnerability.

    Fixed in 0:0.3.0-8.el7_7
  7. Upgrade

    Upgrade redhat/slirp4netns to a version that resolves this vulnerability.

    Fixed in 0:0.4.2-3.git21fdece.el8
  8. Upgrade

    Upgrade redhat/qemu-kvm-rhev to a version that resolves this vulnerability.

    Fixed in 10:2.12.0-33.el7_7.10
  9. Upgrade

    Upgrade redhat/qemu-kvm-rhev to a version that resolves this vulnerability.

    Fixed in 10:2.12.0-44.el7
  10. Upgrade

    Upgrade redhat/qemu-kvm-rhev to a version that resolves this vulnerability.

    Fixed in 10:2.12.0-44.el7_8.1
  11. Upgrade

    Upgrade redhat/qemu-kvm-rhev to a version that resolves this vulnerability.

    Fixed in 10:2.12.0-18.el7_6.11
  12. Upgrade

    Upgrade redhat/libslirp to a version that resolves this vulnerability.

    Fixed in 4.2.0
  13. Upgrade

    Upgrade debian/libslirp to a version that resolves this vulnerability.

    Fixed in 4.4.0-1+deb11u2Fixed in 4.7.0-1Fixed in 4.8.0-1+deb13u1Fixed in 4.9.3-1
  14. Upgrade

    Upgrade debian/qemu to a version that resolves this vulnerability.

    Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u5Fixed in 1:7.2+dfsg-7+deb12u18Fixed in 1:7.2+dfsg-7+deb12u15Fixed in 1:10.0.11+ds-0+deb13u1Fixed in 1:10.0.2+ds-2+deb13u1Fixed in 1:11.0.2+ds-2
  15. Upgrade

    Upgrade debian/slirp to a version that resolves this vulnerability.

    Fixed in 1:1.0.17-11Fixed in 1:1.0.17-12

Event History

Jan 7, 2020
CVE Published
12:00 AM
Jan 16, 2020
CVE Published
via MITRE·10:51 PM
Data Sourced
via MITRE·10:51 PM
Description
Data Sourced
via NVD·11:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·11:52 PM
Description
Feb 23, 2026
Data Sourced
via Ubuntu·08:49 PM
RemedyDescriptionSeverityAffected Software
Jul 16, 2026
Data Sourced
via Debian·11:41 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2020-7039.

2

What is the affected software?

The affected software includes libslirp 4.1.0 as used in QEMU 4.2.0.

3

What is the severity of CVE-2020-7039?

CVE-2020-7039 has a severity rating of high.

4

How does the vulnerability in tcp_emu affect the QEMU process?

The vulnerability can lead to a denial of service or potential remote code execution by crashing the QEMU process on the host.

5

Are there any fixes or remedies available?

Yes, there are fixes available. Please refer to the provided references for more information on the fixes.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203