Bug 1919210 (CVE-2021-20196) - CVE-2021-20196 QEMU: block: fdc: null pointer dereference may lead to guest crash
Summary: CVE-2021-20196 QEMU: block: fdc: null pointer dereference may lead to guest c...
Status: NEW
Alias: CVE-2021-20196
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1921548 1944624 1919532 1919533 1921546 1921547 1921549 1929016 1929017 1929019 1929020
Blocks: 1909094
TreeView+ depends on / blocked
Reported: 2021-01-22 12:02 UTC by Prasad J Pandit
Modified: 2021-08-04 09:35 UTC (History)
35 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Clone Of:
Last Closed:

Attachments (Terms of Use)

Description Prasad J Pandit 2021-01-22 12:02:50 UTC
A NULL pointer dereference issue was found in the Floopy disk emulator of QEMU. It could occur while processing read/write ioport commands, if the selected Floopy drive is not initialised with a block device. A privileged guest user could use this flaw to crash the QEMU process on the host resulting in DoS scenario.

Upstream patch:
  -> https://lists.nongnu.org/archive/html/qemu-devel/2021-01/msg05986.html

Comment 1 Prasad J Pandit 2021-01-22 12:02:55 UTC

Name: Gaoning Pan (Zhejiang University & Ant Security Light-Year Lab)

Comment 4 Prasad J Pandit 2021-01-23 13:13:22 UTC
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1919532]

Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1919533]

Comment 10 RaTasha Tillery-Smith 2021-02-22 18:54:28 UTC

This issue affects the version of the qemu-kvm package shipped with Red Hat Enterprise Linux 5, 6, 7 and 8. Future qemu-kvm package updates for Red Hat Enterprise Linux 7 and 8 may address this issue.

This has been rated as having Low security impact and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 5 & 6. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Note You need to log in before you can comment on or make changes to this bug.