Vulnerability Details : CVE-2020-13659

address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.

Vulnerability category: Memory Corruption

Published 2020-06-02 13:15:11

Updated 2022-11-16 03:37:33

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2020-13659

Probability of exploitation activity in the next 30 days: 0.05%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 14 % EPSS Score History EPSS FAQ

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
1.9	LOW	AV:L/AC:M/Au:N/C:N/I:N/A:P	3.4	2.9	nvd@nist.gov
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
2.5	LOW	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L	0.8	1.4	nvd@nist.gov
Attack Vector: Local Attack Complexity: High Privileges Required: High User Interaction: None Scope: Changed Confidentiality: None Integrity: None Availability: Low

CWE-476 NULL Pointer Dereference

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Assigned by: nvd@nist.gov (Primary)

http://www.openwall.com/lists/oss-security/2020/06/01/3

oss-security - CVE-2020-13659 QEMU: exec: address_space_map returns NULL without setting length to zero may lead to DoS
Mailing List;Patch;Third Party Advisory
https://security.netapp.com/advisory/ntap-20200608-0007/

June 2020 QEMU Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://www.debian.org/security/2020/dsa-4728

Debian -- Security Information -- DSA-4728-1 qemu
Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html

[SECURITY] [DLA 2288-1] qemu security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg07313.html

Re: [PATCH v4] exec: set map length to zero when returning NULL
Mailing List;Patch;Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html

[security-announce] openSUSE-SU-2020:1108-1: important: Security update
Broken Link;Mailing List;Third Party Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/202011-09

QEMU: Multiple vulnerabilities (GLSA 202011-09) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://usn.ubuntu.com/4467-1/

USN-4467-1: QEMU vulnerabilities | Ubuntu security notices | Ubuntu
Third Party Advisory

CVEs referencing this url

Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 18.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 20.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
Matching versions
Qemu » Qemu » Version: 4.2.0
cpe:2.3:a:qemu:qemu:4.2.0:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.2
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
Matching versions