Vulnerability Details : CVE-2019-20175
Potential exploit
An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system via a special SCSI_IOCTL_SEND_COMMAND. It hits an assertion that implies that the size of successful DMA transfers there must be a multiple of 512 (the size of a sector). NOTE: a member of the QEMU security team disputes the significance of this issue because a "privileged guest user has many ways to cause similar DoS effect, without triggering this assert.
Vulnerability category: Denial of service
Products affected by CVE-2019-20175
- cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-20175
0.54%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 66 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-20175
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2019-20175
-
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-20175
-
https://lists.nongnu.org/archive/html/qemu-devel/2019-11/msg02165.html
[PATCH v2 1/1] ide: check DMA transfer size in ide_dma_cb() to prevent qMailing List;Patch;Third Party Advisory
-
https://lists.nongnu.org/archive/html/qemu-devel/2019-11/msg00597.html
Re: [QEMU-SECURITY] ide: fix assertion in ide_dma_cb() to prevent qemu DThird Party Advisory
-
https://www.mail-archive.com/qemu-devel@nongnu.org/msg667396.html
[PATCH v3 0/2] ide: Fix incorrect handling of some PRDTs and add the corresponding unit-testPatch;Third Party Advisory
-
https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg01651.html
[Qemu-devel] [QEMU-SECURITY] ide: fix assertion in ide_dma_cb() to preveExploit;Mailing List;Third Party Advisory
-
https://www.mail-archive.com/qemu-devel%40nongnu.org/msg667396.html
[PATCH v3 0/2] ide: Fix incorrect handling of some PRDTs and add the corresponding unit-test
-
https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg03869.html
Re: [Qemu-devel] [Qemu-block] [QEMU-SECURITY] ide: fix assertion in ide_Mailing List;Third Party Advisory
Jump to