Home

CVE-2019-20808

Description

In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in the ati_cursor_define() routine while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.

Risk Information

Base Score
6.5
MODERATE
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
EPSS Score
Exploitation Probability
0.121

Associated Vulnerability

VulnerabilityOS Platform
Qemu update (ELSA-2021-9104) qemu-4.2.1-5.el7.x86_64.rpmLinux
Qemu-block-gluster update (ELSA-2021-9104) qemu-block-gluster-4.2.1-5.el7.x86_64.rpmLinux
Qemu-block-iscsi update (ELSA-2021-9104) qemu-block-iscsi-4.2.1-5.el7.x86_64.rpmLinux
Qemu-block-rbd update (ELSA-2021-9104) qemu-block-rbd-4.2.1-5.el7.x86_64.rpmLinux
Qemu-common update (ELSA-2021-9104) qemu-common-4.2.1-5.el7.x86_64.rpmLinux
Qemu-img update (ELSA-2021-9104) qemu-img-4.2.1-5.el7.x86_64.rpmLinux
Qemu-kvm update (ELSA-2021-9104) qemu-kvm-4.2.1-5.el7.x86_64.rpmLinux
Qemu-kvm-core update (ELSA-2021-9104) qemu-kvm-core-4.2.1-5.el7.x86_64.rpmLinux
Qemu-system-x86 update (ELSA-2021-9104) qemu-system-x86-4.2.1-5.el7.x86_64.rpmLinux
Qemu-system-x86-core update (ELSA-2021-9104) qemu-system-x86-core-4.2.1-5.el7.x86_64.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234