Vulnerability Description
An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati-2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Qemu | Qemu | >= 4.0.1, <= 4.2.0 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2020/04/24/2Mailing ListPatchThird Party Advisory
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ac2071c3791b67fc7af78b8ceb320c01
- https://usn.ubuntu.com/4372-1/
- http://www.openwall.com/lists/oss-security/2020/04/24/2Mailing ListPatchThird Party Advisory
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ac2071c3791b67fc7af78b8ceb320c01
- https://usn.ubuntu.com/4372-1/
FAQ
What is CVE-2020-11869?
CVE-2020-11869 is a vulnerability with a CVSS score of 3.3 (LOW). An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati-2d.c while handling MMIO write ope...
How severe is CVE-2020-11869?
CVE-2020-11869 has been rated LOW with a CVSS base score of 3.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-11869?
Check the references section above for vendor advisories and patch information. Affected products include: Qemu Qemu.