PT-2023-4687 · Qemu+2 · Qemu+2

Yifan Lu · Publicado 2023-08-28 · Atualizado 2024-08-04 · CVE-2020-24165

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QEMU version 4.2.0

Description An issue was discovered in the TCG Accelerator component of QEMU, related to the use of memory after it has been freed. This issue allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS). Note that this is disputed as a bug and not a valid security issue by multiple third parties.

Recommendations For QEMU version 4.2.0, at the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

BDU:2023-05104

CVE-2020-24165

DLA-3604-1

OESA-2023-1654

OESA-2023-1655

USN-6567-1

USN-6567-2

Produtos afetados

Linuxmint

Qemu

Ubuntu

Referências · 80

• https://ubuntu.com/security/CVE-2023-40360 · Aviso do Fabricante
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1654 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40360 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-02140 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2020-13791 · Nota de Segurança
• https://bugs.launchpad.net/qemu/+bug/1863025 · Nota
• https://osv.dev/vulnerability/OESA-2023-1655 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-05003 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1908004 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3638 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-3301 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-6567-2 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20231006-0012 · Nota
• https://cve.org/CVERecord?id=CVE-2020-24165 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4135 · Nota de Segurança