CVE-2020-25723

EPSS 0.06%
Veröffentlicht 02.12.2020 01:15:12
Zuletzt bearbeitet 21.11.2024 05:18:34
Quelle secalert@redhat.com
Teams Watchlist Login
Unerledigt Login

A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 7

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Qemu ≫ Qemu Version <= 5.1.1

Debian ≫ Debian Linux Version10.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.06%	0.172

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	3.2	1.5	1.4	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
nvd@nist.gov	2.1	3.9	2.9	AV:L/AC:L/Au:N/C:N/I:N/A:P

CWE-617 Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html

Third Party Advisory

Mailing List

http://www.openwall.com/lists/oss-security/2020/12/22/1

Patch

Third Party Advisory

Mailing List

https://bugzilla.redhat.com/show_bug.cgi?id=1898579

Patch

Third Party Advisory

Issue Tracking

https://security.netapp.com/advisory/ntap-20201218-0004/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2020-25723

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-25723

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-25723

EUVD