Bug 1847584 (CVE-2020-24352) - CVE-2020-24352 QEMU: out-of-bounds read/write in ati-vga device emulation in ati_2d_blt()
Summary: CVE-2020-24352 QEMU: out-of-bounds read/write in ati-vga device emulation in ...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2020-24352
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1847385 (view as bug list)
Depends On: 1868904 1910681
Blocks: 1844123
TreeView+ depends on / blocked
 
Reported: 2020-06-16 16:12 UTC by Mauro Matteo Cascella
Modified: 2021-02-16 19:52 UTC (History)
37 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds memory access flaw was found in the ATI VGA device implementation of the QEMU emulator. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
Clone Of:
Environment:
Last Closed: 2020-08-14 09:15:20 UTC
Embargoed:

Attachments (Terms of Use)

Description Mauro Matteo Cascella 2020-06-16 16:12:00 UTC 
An out-of-bounds read/write flaw was found in the ATI VGA device implementation of the QEMU emulator. It occurs in the ati_2d_blt() routine while handling MMIO write operations from the guest. A malicious guest user could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
Comment 1 Mauro Matteo Cascella 2020-06-16 16:12:02 UTC 
Acknowledgments:

Name: Yi Ren (Alibaba Cloud Intelligence Security Team)
Comment 2 Mauro Matteo Cascella 2020-06-16 16:13:45 UTC 
Statement:

This flaw did not affect the following versions of QEMU as they did not include support for ATI VGA emulation:
* `qemu-kvm-ma` as shipped with Red Hat Enterprise Linux 7.
* `qemu-kvm-rhev` as shipped with Red Hat Virtualization and Red Hat OpenStack.
* `qemu-kvm` as shipped with Red Hat Enterprise Linux 6, 7 and 8.
* `virt:8.2/qemu-kvm` as shipped with RHEL Advanced Virtualization.

ATI VGA emulation feature was introduced in QEMU upstream version 4.0.0.
Comment 3 Mauro Matteo Cascella 2020-08-13 16:37:49 UTC 
*** Bug 1847385 has been marked as a duplicate of this bug. ***
Comment 4 Mauro Matteo Cascella 2020-08-14 08:54:53 UTC 
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1868904]
Comment 5 Product Security DevOps Team 2020-08-14 09:15:20 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-24352
Note You need to log in before you can comment on or make changes to this bug.