Back to search
CVE-2020-35506
Published: May 28, 2021
Modified: Aug 4, 2024
PUBLISHED
Description
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.
| Vendor | Product | Versions |
|---|---|---|
n/a | QEMU | affected qemu 6.0.0 |
Weaknesses (CWE)
References
[oss-security] 20210416 QEMU: ESP security fixes
mailing-list
x_refsource_MLIST
https://www.openwall.com/lists/oss-security/2021/04/16/3
x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1909996
x_refsource_MISC
https://security.netapp.com/advisory/ntap-20210713-0006/
x_refsource_CONFIRM
GLSA-202208-27
vendor-advisory
x_refsource_GENTOO
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now