CVE-2020-24352

Name
CVE-2020-24352
Description
An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Vendor Advisory https://git.qemu.org/?p=qemu.git
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1847584
Third Party Advisory https://security.netapp.com/advisory/ntap-20201123-0003/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* qemu >= None <= 4.2.1
cpe:2.3:a:qemu:qemu:5.0.0:rc0:*:*:*:*:*:* qemu == None == 5.0.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
qemu 3.10-main 4.0.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable