CVE-2020-1711

Katalog CVE

CVSS 6.0 · Medium EPSS 4,0%

Kerentanan Heap-based Buffer Overflow pada qemu, redhat openstack +3 lainnya. Skor CVSS 3.1 6.0 (Medium) menurut NVD.

Deskripsi (NVD)

An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.

Rincian

Terbit di NVD

11 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.0 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

4,0% peluang dieksploitasi; lebih tinggi dari 90,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1711 issue tracking · patch · advisory pihak ketiga
• https://lists.gnu.org/archive/html/qemu-devel/2020-01/msg05535.html mailing list · patch · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2020:0669 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2020:0730 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2020:0731 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2020:0773 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/03/msg00017.html advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202005-02 advisory pihak ketiga
• https://usn.ubuntu.com/4283-1/ advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2020/01/23/3 mailing list · advisory pihak ketiga