PT-2020-4100 · Libslirp+9 · Libslirp+9
Laszlo Ersek
·
Published
2020-02-06
·
Updated
2024-11-08
·
CVE-2020-8608
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
libslirp version 4.1.0
QEMU version 4.2.0
Description:
The issue is related to a component of the Libslirp TCP-IP emulator, specifically the tcp subr.c library, which has an insufficient mechanism for checking the size of copied data. This allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem arises from the misuse of snprintf return values in the tcp subr.c file, leading to a buffer overflow in later code.
Recommendations:
For libslirp version 4.1.0, consider updating to a newer version that addresses the buffer overflow issue in the tcp subr.c library.
For QEMU version 4.2.0, update to a version that includes the fix for the libslirp component to prevent exploitation of the buffer overflow vulnerability.
As a temporary workaround, consider restricting access to the tcp subr.c component until a patch is available.
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Qemu
Red Hat
Rocky Linux
Suse
Ubuntu
Libslirp