Bug 1841136 (CVE-2019-20808) - CVE-2019-20808 QEMU: out-of-bounds read in ati_cursor_define() function in hw/display/ati.c leads to DoS
Summary: CVE-2019-20808 QEMU: out-of-bounds read in ati_cursor_define() function in hw...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2019-20808
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1841160 1910694
Blocks: 1752920
TreeView+ depends on / blocked
 
Reported: 2020-05-28 13:05 UTC by Mauro Matteo Cascella
Modified: 2022-04-17 20:56 UTC (History)
35 users (show)

Fixed In Version: qemu 4.2.0
Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds read flaw was found in the ATI VGA implementation of the QEMU emulator. This flaw occurs in the ati_cursor_define() routine while handling MMIO write operations through ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.
Clone Of:
Environment:
Last Closed: 2020-05-28 17:20:49 UTC
Embargoed:

Attachments (Terms of Use)

Description Mauro Matteo Cascella 2020-05-28 13:05:06 UTC 
An out-of-bounds read flaw was found in function ati_cursor_define() in hw/display/ati.c, leading to possible denial of service under certain conditions.

Upstream fix:
https://git.qemu.org/?p=qemu.git;a=commit;h=aab0e2a661b2b6bf7915c0aefe807fb60d6d9d13
Comment 2 Mauro Matteo Cascella 2020-05-28 13:21:16 UTC 
Statement:

This flaw did not affect the following versions of QEMU as they did not include support for ATI VGA emulation:
* `qemu-kvm-ma` as shipped with Red Hat Enterprise Linux 7.
* `qemu-kvm-rhev` as shipped with Red Hat Virtualization and Red Hat OpenStack.
* `qemu-kvm` as shipped with Red Hat Enterprise Linux 6, 7 and 8.
* `virt:8.2/qemu-kvm` as shipped with RHEL Advanced Virtualization.

ATI VGA emulation feature was introduced in QEMU upstream version 4.0.0.
Comment 3 Mauro Matteo Cascella 2020-05-28 14:00:57 UTC 
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1841160]
Comment 4 Product Security DevOps Team 2020-05-28 17:20:49 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-20808
Note You need to log in before you can comment on or make changes to this bug.