PT-2022-7373 · Qemu+6 · Qemu+6

Gaoning Pan + 1 · Published 2022-08-17 · Updated 2026-06-09 · CVE-2020-14394

Positive Technologies (AI Summary)

CVSS v3.1

3.2

Low

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions QEMU (affected versions not specified)

Description A flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring, allowing a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALT-PU-2022-3081

ALT-PU-2022-3083

ALT-PU-2022-3390

ALT-PU-2023-1830

ALT-PU-2023-1869

BDU:2024-04482

CVE-2020-14394

DLA-3362-1

OESA-2022-1918

SUSE-SU-2023:0761-1

SUSE-SU-2023:0840-1

SUSE-SU-2023:0879-1

SUSE-SU-2023:0879-2

SUSE-SU-2023_0879-1

USN-6567-1

USN-6567-2

USN-8412-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Qemu

Red Os

Suse

Ubuntu

References · 113

• 🔥 https://github.com/QiuhaoLi/CVE-2021-3929-3947 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1908004 · Exploit
• 🔥 https://gitlab.com/qemu-project/qemu/-/issues/646 · Exploit
• https://ubuntu.com/security/CVE-2021-4206 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27617 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20257 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-24165 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15863 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04482 · Security Note
• https://ubuntu.com/security/CVE-2020-15469 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14394 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8412-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-3446 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-40360 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7J5IRXJYLELW7D43A75LOWRUE5EU54O · Vendor Advisory