Bug 1847584 (CVE-2020-24352)
| Summary: | CVE-2020-24352 QEMU: out-of-bounds read/write in ati-vga device emulation in ati_2d_blt() | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Mauro Matteo Cascella <mcascell> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | ailan, amit, berrange, cfergeau, dbecker, drjones, dwmw2, imammedo, itamar, jen, jferlan, jforbes, jjoyce, jmaloy, jschluet, kbasil, knoel, lhh, lkundrak, lpeer, m.a.young, mburns, mkenneth, mrezanin, mst, pbonzini, philmd, ribarry, rjones, robinlee.sysu, sclewis, security-response-team, slinaber, virt-maint, virt-maint, vkuznets, xen-maint |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
An out-of-bounds memory access flaw was found in the ATI VGA device implementation of the QEMU emulator. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-08-14 09:15:20 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1868904, 1910681 | ||
| Bug Blocks: | 1844123 | ||
|
Description
Mauro Matteo Cascella
2020-06-16 16:12:00 UTC
Acknowledgments: Name: Yi Ren (Alibaba Cloud Intelligence Security Team) Statement: This flaw did not affect the following versions of QEMU as they did not include support for ATI VGA emulation: * `qemu-kvm-ma` as shipped with Red Hat Enterprise Linux 7. * `qemu-kvm-rhev` as shipped with Red Hat Virtualization and Red Hat OpenStack. * `qemu-kvm` as shipped with Red Hat Enterprise Linux 6, 7 and 8. * `virt:8.2/qemu-kvm` as shipped with RHEL Advanced Virtualization. ATI VGA emulation feature was introduced in QEMU upstream version 4.0.0. *** Bug 1847385 has been marked as a duplicate of this bug. *** Created qemu tracking bugs for this issue: Affects: fedora-all [bug 1868904] This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-24352 |