PT-2020-5091 · Qemu+7 · Qemu+7
Felipe Franciosi
+2
·
Published
2020-01-24
·
Updated
2026-06-09
·
CVE-2020-1711
CVSS v3.1
7.7
High
| Vector | AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
QEMU versions 2.12.0 through 4.2.1
Description
The issue is related to an out-of-bounds heap buffer access flaw in the iSCSI Block driver. This flaw can be exploited by a remote user to potentially execute arbitrary code or cause a denial of service by crashing the QEMU process. The exploitation is tied to how the iSCSI server response is handled during the checking of a Logical Address Block (LBA) status in the
iscsi co block status() routine.Recommendations
For QEMU versions 2.12.0 through 4.2.1, update to version 4.2.1 or later to resolve the issue.
As a temporary workaround, consider restricting access to the iSCSI Block driver to minimize the risk of exploitation.
Fix
DoS
Out of bounds Read
Heap Based Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Qemu
Red Hat
Rocky Linux
Suse
Ubuntu