CVE-2020-11102 - hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the f

CVE-2020-11102

Summary

hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the frame size is not validated against the r/w data length.

References

http://www.openwall.com/lists/oss-security/2020/04/06/1
https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg08322.html
https://security.gentoo.org/glsa/202005-02

Vulnerable Configurations

cpe:2.3:a:qemu:qemu:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:4.2.0:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 13-05-2020 - 01:15)
Impact:
Exploitability:

CWE

CWE-787

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

confirm	http://www.openwall.com/lists/oss-security/2020/04/06/1
gentoo	GLSA-202005-02
misc	https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg08322.html
mlist	[oss-security] 20200406 CVE-2020-11102 QEMU: tulip: OOB access in tulip_copy_tx_buffers

Last major update

13-05-2020 - 01:15

Published

06-04-2020 - 16:15

Last modified

13-05-2020 - 01:15