CVE-2020-13659 - address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBu

CVE-2020-13659

Summary

address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.

References

Vulnerable Configurations

cpe:2.3:a:qemu:qemu:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:4.2.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

CVSS

CWE

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:L/AC:M/Au:N/C:N/I:N/A:P

refmap via4

confirm	http://www.openwall.com/lists/oss-security/2020/06/01/3 https://security.netapp.com/advisory/ntap-20200608-0007/
debian	DSA-4728
gentoo	GLSA-202011-09
misc	https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg07313.html
mlist	[debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update
suse	openSUSE-SU-2020:1108
ubuntu	USN-4467-1

Last major update

16-11-2022 - 03:37

Published

02-06-2020 - 13:15

Last modified

16-11-2022 - 03:37