CVE-2020-35505

Name
CVE-2020-35505
Description
A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MLIST http://www.openwall.com/lists/oss-security/2021/04/16/3
MISC https://www.openwall.com/lists/oss-security/2021/04/16/3
MISC https://bugzilla.redhat.com/show_bug.cgi?id=1909769
CONFIRM https://security.netapp.com/advisory/ntap-20210713-0006/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* qemu >= None < 6.0.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status