An out-of-bound write access issue was found in the way QEMU loads ROM contents at boot time. It occurs in rom_copy() routine while loading contents of a 32-bit -kernel image into memory. Running an untrusted -kernel image may load contents at arbitrary memory locations, potentially leading to code execution with the privileges of the QEMU process. Upstream patch: --------------- -> https://git.qemu.org/?p=qemu.git;a=commitdiff;h=e423455c4f23a1a828901c78fe6d03b7dde79319 Reference: ---------- -> https://bugs.launchpad.net/qemu/+bug/1844635 -> https://www.openwall.com/lists/oss-security/2020/06/03/6
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2021:0347 https://access.redhat.com/errata/RHSA-2021:0347
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-13765
Statement: In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP qemu-kvm-rhev package.