CVE-2020-35506

EUVD-2020-23175
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.7 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 8%
Affected Products (NVD)
VendorProductVersion
qemuqemu
𝑥
< 6.0.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
qemu
bookworm
1:7.2+dfsg-7+deb12u7
fixed
bullseye
ignored
bullseye (security)
vulnerable
buster
not-affected
sid
1:9.1.1+ds-2
fixed
stretch
not-affected
trixie
1:9.1.1+ds-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
qemu
bionic
not-affected
focal
not-affected
groovy
not-affected
hirsute
not-affected
impish
Fixed 1:6.0+dfsg-1~ubuntu3
released
jammy
Fixed 1:6.0+dfsg-1~ubuntu3
released
trusty
not-affected
xenial
not-affected
qemu-kvm
bionic
dne
focal
dne
groovy
dne
hirsute
dne
impish
dne
jammy
dne
trusty
dne
xenial
dne
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2021/04/16/3
https://bugzilla.redhat.com/show_bug.cgi?id=1909996
https://security.gentoo.org/glsa/202208-27
https://security.netapp.com/advisory/ntap-20210713-0006/
https://www.openwall.com/lists/oss-security/2021/04/16/3
http://www.openwall.com/lists/oss-security/2021/04/16/3
https://bugzilla.redhat.com/show_bug.cgi?id=1909996
https://security.gentoo.org/glsa/202208-27
https://security.netapp.com/advisory/ntap-20210713-0006/
https://www.openwall.com/lists/oss-security/2021/04/16/3