Vulnerability Details : CVE-2020-13800
ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call.
Products affected by CVE-2020-13800
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
- cpe:2.3:a:qemu:qemu:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-13800
0.05%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 12 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-13800
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.9
|
MEDIUM | AV:L/AC:L/Au:N/C:N/I:N/A:C |
3.9
|
6.9
|
NIST | |
6.0
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H |
1.5
|
4.0
|
NIST |
CWE ids for CVE-2020-13800
-
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-13800
-
https://www.openwall.com/lists/oss-security/2020/06/04/2
oss-security - CVE-2020-13800 QEMU: ati-vga: infinite recursion in ati_mm_read/write calls may lead to DoSMailing List;Third Party Advisory
-
https://security.netapp.com/advisory/ntap-20200717-0001/
June 2020 QEMU Vulnerabilities in NetApp Products | NetApp Product SecurityThird Party Advisory
-
https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00825.html
[PATCH v2] ati-vga: check mm_index before recursive callMailing List;Vendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html
[security-announce] openSUSE-SU-2020:1108-1: important: Security updateMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/202011-09
QEMU: Multiple vulnerabilities (GLSA 202011-09) — Gentoo securityThird Party Advisory
-
https://cve.openeuler.org/cve#/CVEInfo/CVE-2020-13800
openEulerBroken Link
-
https://usn.ubuntu.com/4467-1/
USN-4467-1: QEMU vulnerabilities | Ubuntu security notices | UbuntuThird Party Advisory
Jump to