CVE-2021-20196: Null Pointer Dereference
A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Other sources
A NULL pointer dereference issue was found in the Floopy disk emulator of QEMU. It could occur while processing read/write ioport commands, if the selected Floopy drive is not initialised with a block device. A privileged guest user could use this flaw to crash the QEMU process on the host resulting in DoS scenario.
Upstream patch: --------------- -> https://lists.nongnu.org/archive/html/qemu-devel/2021-01/msg05986.html
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this QEMU vulnerability?
The vulnerability ID of this QEMU vulnerability is CVE-2021-20196.
What is the severity level of the QEMU vulnerability CVE-2021-20196?
The severity level of the QEMU vulnerability CVE-2021-20196 is medium with a CVSS score of 6.5.
How does the QEMU vulnerability CVE-2021-20196 occur?
The QEMU vulnerability CVE-2021-20196 occurs due to a NULL pointer dereference flaw in the floppy disk emulator.
What are the affected software versions of the QEMU vulnerability CVE-2021-20196?
The affected software versions of the QEMU vulnerability CVE-2021-20196 are QEMU 5.2.0, Debian Debian Linux 9.0, and Debian Debian Linux 10.0.
Is there a fix available for the QEMU vulnerability CVE-2021-20196?
Yes, there are fixes available for the QEMU vulnerability CVE-2021-20196. Please refer to the provided references for more information.