Back to search
CVE-2020-35505
Published: May 28, 2021
Modified: Aug 4, 2024
PUBLISHED
Description
A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
| Vendor | Product | Versions |
|---|---|---|
n/a | QEMU | affected qemu 6.0.0 |
Weaknesses (CWE)
References
[oss-security] 20210416 QEMU: ESP security fixes
mailing-list
x_refsource_MLIST
https://www.openwall.com/lists/oss-security/2021/04/16/3
x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1909769
x_refsource_MISC
https://security.netapp.com/advisory/ntap-20210713-0006/
x_refsource_CONFIRM
GLSA-202208-27
vendor-advisory
x_refsource_GENTOO
[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update
mailing-list
x_refsource_MLIST
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now