NULL Pointer Dereference Affecting qemu package, versions <1:3.1+dfsg-8+deb10u9


0.0
medium

Snyk CVSS

    Attack Complexity Low
    Privileges Required High
    Availability High

    Threat Intelligence

    EPSS 0.05% (13th percentile)
Expand this section
NVD
4.4 medium
Expand this section
SUSE
4.4 medium
Expand this section
Red Hat
3.2 low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN10-QEMU-1054860
  • published 29 Dec 2020
  • disclosed 28 May 2021

How to fix?

Upgrade Debian:10 qemu to version 1:3.1+dfsg-8+deb10u9 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream qemu package and not the qemu package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.