Not rated
CVE-2020-35505 A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before…
Description
A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| QEMU | Versions not published |
References
- [oss-security] 20210416 QEMU: ESP security fixes www.openwall.com
- www.openwall.com www.openwall.com
- bugzilla.redhat.com bugzilla.redhat.com
- security.netapp.com security.netapp.com
- GLSA-202208-27 security.gentoo.org
- [debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of QEMU
The 60 CVEs of QEMU →
CVE-2023-2680
This CVE exists because of an incomplete fix for CVE-2021-3750
7.5
High
CVE-2023-3301
A flaw was found in QEMU
5.6
Medium
CVE-2023-3180
A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in…
6.0
Medium
CVE-2023-1386
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU
3.3
Low