NULL Pointer Dereference Affecting qemu package, versions *
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UBUNTU1404-QEMU-1055740
- published 6 Jan 2021
- disclosed 28 May 2021
Introduced: 6 Jan 2021
CVE-2020-35505 Open this link in a new tabHow to fix?
There is no fixed version for Ubuntu:14.04 qemu.
NVD Description
Note: Versions mentioned in the description apply only to the upstream qemu package and not the qemu package as distributed by Ubuntu.
See How to fix? for Ubuntu:14.04 relevant fixed versions and status.
A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
References
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-35505
- https://bugzilla.redhat.com/show_bug.cgi?id=1909769
- https://www.openwall.com/lists/oss-security/2021/04/16/3
- http://www.openwall.com/lists/oss-security/2021/04/16/3
- https://security.netapp.com/advisory/ntap-20210713-0006/
- https://security.gentoo.org/glsa/202208-27
- https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html