PT-2020-6468 · Qemu+4 · Qemu+4

Eric Blake + 1 · Published 2020-06-09 · Updated 2024-06-15 · CVE-2020-10761

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 5.0.1

Description An assertion failure issue was found in the Network Block Device (NBD) Server. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server, resulting in a denial of service.

Recommendations For QEMU versions prior to 5.0.1, update to QEMU 5.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the NBD server to minimize the risk of exploitation.

Fix

DoS

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

ALT-PU-2020-2431

ALT-PU-2020-2595

ALT-PU-2021-1880

ALT-PU-2021-1964

BDU:2021-05172

CVE-2020-10761

OPENSUSE-SU-2020:1108-1

OPENSUSE-SU-2020_1108-1

OPENSUSE-SU-2024:11287-1

SUSE-SU-2020:2015-1

SUSE-SU-2020_2015-1

USN-4467-1

USN-4467-3

Affected Products

Alt Linux

Linuxmint

Qemu

Suse

Ubuntu

References · 181

• https://nvd.nist.gov/vuln/detail/CVE-2020-10761 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-10761 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-10761 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14415 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4467-1 · Vendor Advisory
• https://openwall.com/lists/oss-security/2020/06/09/1 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2020:2015-1 · Vendor Advisory
• https://usn.ubuntu.com/4467-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1108-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05172 · Security Note
• https://ubuntu.com/security/CVE-2020-13253 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-10761 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13362 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10756 · Vendor Advisory