CVE-2020-8608: Buffer Overflow

Published Jan 27, 2020
·
Updated

A out-of-bounds heap buffer access issue was found in the SLiRP networking implementation of the QEMU emulator. It occurs in tcpemu() routine while emulating IRC and other protocols due to unsafe usage of snprintf(3) function.

A user/process could use this flaw to crash the Qemu process on the host resulting in DoS or potentially execute arbitrary code with privileges of the QEMU process on the host. Also with SELinux and sVirt access control in place, malicious activity is restricted.

Upstream patch: --------------- -> https://gitlab.freedesktop.org/slirp/libslirp/commit/68ccb8021a838066f0951d4b2817eb6b6f10a843 -> https://gitlab.freedesktop.org/slirp/libslirp/commit/30648c03b27fb8d9611b723184216cd3174b6775

Reference: ---------- -> https://www.openwall.com/lists/oss-security/2020/02/06/2

Other sources

An out-of-bounds heap buffer access flaw was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in tcpemu() routine while emulating IRC and other protocols due to unsafe usage of the snprintf(3) function. A user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.

In libslirp 4.1.0, as used in QEMU 4.2.0, tcpsubr.c misuses snprintf return values, leading to a buffer overflow in later code.

Affected Software

34 affected componentsFixes available
redhat/qemu-kvm<2:0.12.1.2-2.506.el6_10.7
2:0.12.1.2-2.506.el6_10.7
redhat/qemu-kvm<10:1.5.3-173.el7_8.1
10:1.5.3-173.el7_8.1
redhat/qemu-kvm-ma<10:2.12.0-44.el7_8.1
10:2.12.0-44.el7_8.1
redhat/qemu-kvm<10:1.5.3-160.el7_6.7
10:1.5.3-160.el7_6.7
redhat/qemu-kvm<10:1.5.3-167.el7_7.6
10:1.5.3-167.el7_7.6
redhat/qemu-kvm-ma<10:2.12.0-33.el7_7.3
10:2.12.0-33.el7_7.3
redhat/slirp4netns<0:0.3.0-8.el7_7
0:0.3.0-8.el7_7
redhat/atomic-enterprise-service-catalog<1:4.3.3-202002170501.git.1.f30799e.el7
1:4.3.3-202002170501.git.1.f30799e.el7
redhat/atomic-openshift-service-idler<0:4.3.3-202002170501.git.1.4feff9c.el7
0:4.3.3-202002170501.git.1.4feff9c.el7
redhat/cri-o<0:1.16.3-20.dev.rhaos4.3.git11c04e3.el7
0:1.16.3-20.dev.rhaos4.3.git11c04e3.el7
redhat/cri-tools<0:1.17.0-1.el8
0:1.17.0-1.el8
redhat/dracut<0:049-64.git20200123.el8
0:049-64.git20200123.el8
redhat/jenkins<0:2.204.1.1581950993-1.el7
0:2.204.1.1581950993-1.el7
redhat/jenkins<2-plugins-0:4.3.1581956184-1.el7
2-plugins-0:4.3.1581956184-1.el7
redhat/machine-config-daemon<0:4.3.3-202002170501.git.1.6b1b155.el8
0:4.3.3-202002170501.git.1.6b1b155.el8
redhat/openshift<0:4.3.3-202002140552.git.0.e38059c.el7
0:4.3.3-202002140552.git.0.e38059c.el7
redhat/openshift-ansible<0:4.3.3-202002142331.git.173.bb0b5a1.el7
0:4.3.3-202002142331.git.173.bb0b5a1.el7
redhat/openshift-clients<0:4.3.3-202002140552.git.1.ff73b47.el7
0:4.3.3-202002140552.git.1.ff73b47.el7
redhat/openshift-kuryr<0:4.3.3-202002170501.git.1.3b8b4cc.el8
0:4.3.3-202002170501.git.1.3b8b4cc.el8
redhat/slirp4netns<0:0.4.2-4.git21fdece.el8
0:0.4.2-4.git21fdece.el8
redhat/toolbox<0:0.0.6-1.rhaos4.3.el8
0:0.0.6-1.rhaos4.3.el8
redhat/qemu-kvm-rhev<10:2.12.0-33.el7_7.10
10:2.12.0-33.el7_7.10
redhat/qemu-kvm-rhev<10:2.12.0-44.el7_8.1
10:2.12.0-44.el7_8.1
redhat/qemu-kvm-rhev<10:2.12.0-18.el7_6.11
10:2.12.0-18.el7_6.11
redhat/libslirp<4.3.0
4.3.0
Libslirp Project Libslirp=4.1.0
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Debian Debian Linux=10.0
openSUSE Leap=15.1
debian/libslirp
4.4.0-1+deb11u24.7.0-14.8.0-1+deb13u14.9.3-1
debian/qemu
1:5.2+dfsg-11+deb11u31:5.2+dfsg-11+deb11u51:7.2+dfsg-7+deb12u181:7.2+dfsg-7+deb12u151:10.0.11+ds-0+deb13u11:10.0.2+ds-2+deb13u11:11.0.2+ds-2
debian/slirp
1:1.0.17-111:1.0.17-12
debian/slirp4netns
1.0.1-21.2.0-11.2.1-1.11.3.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/qemu-kvm to a version that resolves this vulnerability.

    Fixed in 2:0.12.1.2-2.506.el6_10.7
  2. Upgrade

    Upgrade redhat/qemu-kvm to a version that resolves this vulnerability.

    Fixed in 10:1.5.3-173.el7_8.1
  3. Upgrade

    Upgrade redhat/qemu-kvm-ma to a version that resolves this vulnerability.

    Fixed in 10:2.12.0-44.el7_8.1
  4. Upgrade

    Upgrade redhat/qemu-kvm to a version that resolves this vulnerability.

    Fixed in 10:1.5.3-160.el7_6.7
  5. Upgrade

    Upgrade redhat/qemu-kvm to a version that resolves this vulnerability.

    Fixed in 10:1.5.3-167.el7_7.6
  6. Upgrade

    Upgrade redhat/qemu-kvm-ma to a version that resolves this vulnerability.

    Fixed in 10:2.12.0-33.el7_7.3
  7. Upgrade

    Upgrade redhat/slirp4netns to a version that resolves this vulnerability.

    Fixed in 0:0.3.0-8.el7_7
  8. Upgrade

    Upgrade redhat/atomic-enterprise-service-catalog to a version that resolves this vulnerability.

    Fixed in 1:4.3.3-202002170501.git.1.f30799e.el7
  9. Upgrade

    Upgrade redhat/atomic-openshift-service-idler to a version that resolves this vulnerability.

    Fixed in 0:4.3.3-202002170501.git.1.4feff9c.el7
  10. Upgrade

    Upgrade redhat/cri-o to a version that resolves this vulnerability.

    Fixed in 0:1.16.3-20.dev.rhaos4.3.git11c04e3.el7
  11. Upgrade

    Upgrade redhat/cri-tools to a version that resolves this vulnerability.

    Fixed in 0:1.17.0-1.el8
  12. Upgrade

    Upgrade redhat/dracut to a version that resolves this vulnerability.

    Fixed in 0:049-64.git20200123.el8
  13. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 0:2.204.1.1581950993-1.el7
  14. Upgrade

    Upgrade redhat/jenkins to a version that resolves this vulnerability.

    Fixed in 2-plugins-0:4.3.1581956184-1.el7
  15. Upgrade

    Upgrade redhat/machine-config-daemon to a version that resolves this vulnerability.

    Fixed in 0:4.3.3-202002170501.git.1.6b1b155.el8
  16. Upgrade

    Upgrade redhat/openshift to a version that resolves this vulnerability.

    Fixed in 0:4.3.3-202002140552.git.0.e38059c.el7
  17. Upgrade

    Upgrade redhat/openshift-ansible to a version that resolves this vulnerability.

    Fixed in 0:4.3.3-202002142331.git.173.bb0b5a1.el7
  18. Upgrade

    Upgrade redhat/openshift-clients to a version that resolves this vulnerability.

    Fixed in 0:4.3.3-202002140552.git.1.ff73b47.el7
  19. Upgrade

    Upgrade redhat/openshift-kuryr to a version that resolves this vulnerability.

    Fixed in 0:4.3.3-202002170501.git.1.3b8b4cc.el8
  20. Upgrade

    Upgrade redhat/slirp4netns to a version that resolves this vulnerability.

    Fixed in 0:0.4.2-4.git21fdece.el8
  21. Upgrade

    Upgrade redhat/toolbox to a version that resolves this vulnerability.

    Fixed in 0:0.0.6-1.rhaos4.3.el8
  22. Upgrade

    Upgrade redhat/qemu-kvm-rhev to a version that resolves this vulnerability.

    Fixed in 10:2.12.0-33.el7_7.10
  23. Upgrade

    Upgrade redhat/qemu-kvm-rhev to a version that resolves this vulnerability.

    Fixed in 10:2.12.0-44.el7_8.1
  24. Upgrade

    Upgrade redhat/qemu-kvm-rhev to a version that resolves this vulnerability.

    Fixed in 10:2.12.0-18.el7_6.11
  25. Upgrade

    Upgrade redhat/libslirp to a version that resolves this vulnerability.

    Fixed in 4.3.0
  26. Upgrade

    Upgrade debian/libslirp to a version that resolves this vulnerability.

    Fixed in 4.4.0-1+deb11u2Fixed in 4.7.0-1Fixed in 4.8.0-1+deb13u1Fixed in 4.9.3-1
  27. Upgrade

    Upgrade debian/qemu to a version that resolves this vulnerability.

    Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u5Fixed in 1:7.2+dfsg-7+deb12u18Fixed in 1:7.2+dfsg-7+deb12u15Fixed in 1:10.0.11+ds-0+deb13u1Fixed in 1:10.0.2+ds-2+deb13u1Fixed in 1:11.0.2+ds-2
  28. Upgrade

    Upgrade debian/slirp to a version that resolves this vulnerability.

    Fixed in 1:1.0.17-11Fixed in 1:1.0.17-12
  29. Upgrade

    Upgrade debian/slirp4netns to a version that resolves this vulnerability.

    Fixed in 1.0.1-2Fixed in 1.2.0-1Fixed in 1.2.1-1.1Fixed in 1.3.3-1

Event History

Jan 27, 2020
CVE Published
12:00 AM
Feb 6, 2020
CVE Published
via MITRE·04:45 PM
Data Sourced
via MITRE·04:45 PM
Description
Data Sourced
via NVD·05:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·11:52 PM
Description
Feb 24, 2026
Data Sourced
via Ubuntu·08:49 PM
RemedyDescriptionSeverityAffected Software
Jul 16, 2026
Data Sourced
via Debian·11:41 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2020-8608?

CVE-2020-8608 is classified as a medium severity vulnerability due to its potential to crash the QEMU process.

2

How do I fix CVE-2020-8608?

To fix CVE-2020-8608, you need to upgrade to a patched version of the QEMU package specified in the security advisories.

3

What is affected by CVE-2020-8608?

CVE-2020-8608 affects the SLiRP networking implementation in various versions of QEMU and related packages.

4

Can CVE-2020-8608 be exploited remotely?

Yes, CVE-2020-8608 can be exploited by an attacker who can send specially crafted data to the emulated network protocols.

5

What are the consequences of CVE-2020-8608 exploitation?

Exploitation of CVE-2020-8608 could lead to a denial of service by crashing the QEMU process.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203