PT-2020-5186 · Qemu+4 · Qemu+4

Published 2020-07-25 · Updated 2022-09-30 · CVE-2020-15863

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 07-20-2020

Description The issue is related to a buffer overflow in the XGMAC Ethernet controller, specifically in the xgmac enet send function. This occurs during packet transmission and affects the highbank and midway emulated machines. Exploitation of this issue could allow an attacker to access protected information, compromise its integrity, and cause a denial of service or potentially execute privileged code.

Recommendations For QEMU versions prior to 07-20-2020, update to a version that includes the fix committed in 5519724a13664b43e225ca05351c60b4468e4555 to resolve the issue. As a temporary workaround, consider restricting access to the XGMAC Ethernet controller functionality to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-120

CWE-787

Related Identifiers

ALT-PU-2020-2595

ALT-PU-2020-3332

ALT-PU-2020-3381

ALT-PU-2021-1880

ALT-PU-2021-1964

BDU:2020-05805

CVE-2020-15863

DLA-2288-1

DSA-4760-1

OPENSUSE-SU-2020:1664-1

OPENSUSE-SU-2020_1664-1

SUSE-SU-2020:2743-1

SUSE-SU-2020:2877-1

SUSE-SU-2021:1240-1

SUSE-SU-2021:1241-1

SUSE-SU-2021:1244-1

SUSE-SU-2021:1245-1

SUSE-SU-2021:1305-1

SUSE-SU-2021:14772-1

SUSE-SU-2021:14774-1

SUSE-SU-2021_14772-1

USN-4467-1

USN-4467-3

Affected Products

Alt Linux

Linuxmint

Qemu

Suse

Ubuntu

References · 132

• https://osv.dev/vulnerability/SUSE-SU-2021:14772-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-27 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15863 · Security Note
• https://linux.oracle.com/errata/ELSA-2021-9034.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1305-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14415 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4467-1 · Vendor Advisory
• https://lists.nongnu.org/archive/html/qemu-devel/2020-07/msg05745.html · Patch
• https://osv.dev/vulnerability/SUSE-SU-2020:2877-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15863 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-15863 · Security Note
• https://bdu.fstec.ru/vul/2020-05805 · Security Note
• http://openwall.com/lists/oss-security/2020/07/22/1 · Patch
• https://usn.ubuntu.com/4467-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory