Vulnerability · Published Feb 11, 2020 · Assigned by redhat
CVE-2020-1711
High 7.7
In plain English
A high-severity heap buffer overflow in QEMU from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.0% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libiscsi | 1.18.0-8.module_el8.5.0+2608+72063365 | ALSA-2020:1358 |
| AlmaLinux:8 | libiscsi | 1.18.0-8.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:1358 |
| AlmaLinux:8 | libiscsi | 1.18.0-8.module_el8.6.0+2880+7d9e3703 | ALSA-2020:1358 |
| AlmaLinux:8 | libiscsi-devel | 1.18.0-8.module_el8.6.0+2880+7d9e3703 | ALSA-2020:1358 |
| AlmaLinux:8 | libiscsi-devel | 1.18.0-8.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:1358 |
| AlmaLinux:8 | libiscsi-devel | 1.18.0-8.module_el8.5.0+2608+72063365 | ALSA-2020:1358 |
| AlmaLinux:8 | libiscsi-utils | 1.18.0-8.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:1358 |
| AlmaLinux:8 | libiscsi-utils | 1.18.0-8.module_el8.6.0+2880+7d9e3703 | ALSA-2020:1358 |
| AlmaLinux:8 | libiscsi-utils | 1.18.0-8.module_el8.5.0+2608+72063365 | ALSA-2020:1358 |
| AlmaLinux:8 | netcf | 0.2.8-12.module_el8.5.0+2608+72063365 | ALSA-2020:1358 |
| AlmaLinux:8 | netcf | 0.2.8-12.module_el8.6.0+2880+7d9e3703 | ALSA-2020:1358 |
| AlmaLinux:8 | netcf | 0.2.8-12.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:1358 |
| AlmaLinux:8 | netcf-devel | 0.2.8-12.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:1358 |
| AlmaLinux:8 | netcf-devel | 0.2.8-12.module_el8.5.0+2608+72063365 | ALSA-2020:1358 |
| AlmaLinux:8 | netcf-devel | 0.2.8-12.module_el8.6.0+2880+7d9e3703 | ALSA-2020:1358 |
| AlmaLinux:8 | netcf-libs | 0.2.8-12.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:1358 |
| AlmaLinux:8 | netcf-libs | 0.2.8-12.module_el8.6.0+2880+7d9e3703 | ALSA-2020:1358 |
| AlmaLinux:8 | netcf-libs | 0.2.8-12.module_el8.5.0+2608+72063365 | ALSA-2020:1358 |
| AlmaLinux:8 | sgabios | 1:0.20170427git-3.module_el8.3.0+2048+e7a0a3ea | ALSA-2020:1358 |
| AlmaLinux:8 | sgabios | 1:0.20170427git-3.module_el8.5.0+2608+72063365 | ALSA-2020:1358 |
| AlmaLinux:8 | sgabios-bin | 1:0.20170427git-3.module_el8.5.0+2608+72063365 | ALSA-2020:1358 |
| AlmaLinux:8 | sgabios-bin | 1:0.20170427git-3.module_el8.6.0+2880+7d9e3703 | ALSA-2020:1358 |
| Debian:12 | qemu | 1:4.2-2 | DEBIAN-CVE-2020-1711 |
| Debian:13 | qemu | 1:4.2-2 | DEBIAN-CVE-2020-1711 |
| Debian:14 | qemu | 1:4.2-2 | DEBIAN-CVE-2020-1711 |
| Rocky Linux:8 | libiscsi | 0:1.18.0-8.module+el8.7.0+1084+97b81f61 | RLSA-2020:1358 |
| Rocky Linux:8 | libiscsi | 0:1.18.0-8.module+el8.4.0+534+4680a14e | RLSA-2020:1358 |
| Rocky Linux:8 | libiscsi | 0:1.18.0-8.module+el8.6.0+847+b490afdd | RLSA-2020:1358 |
| Rocky Linux:8 | netcf | 0:0.2.8-12.module+el8.7.0+1084+97b81f61 | RLSA-2020:1358 |
| Rocky Linux:8 | netcf | 0:0.2.8-12.module+el8.4.0+534+4680a14e | RLSA-2020:1358 |
| Rocky Linux:8 | netcf | 0:0.2.8-12.module+el8.6.0+847+b490afdd | RLSA-2020:1358 |
| Rocky Linux:8 | sgabios | 1:0.20170427git-3.module+el8.6.0+847+b490afdd | RLSA-2020:1358 |
| Rocky Linux:8 | sgabios | 1:0.20170427git-3.module+el8.4.0+534+4680a14e | RLSA-2020:1358 |
| Rocky Linux:8 | sgabios | 1:0.20170427git-3.module+el8.7.0+1084+97b81f61 | RLSA-2020:1358 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1711 x_refsource_CONFIRM
- https://lists.gnu.org/archive/html/qemu-devel/2020-01/msg05535.html x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2020/01/23/3 x_refsource_MISC
- USN-4283-1 vendor-advisory, x_refsource_UBUNTU
- RHSA-2020:0669 vendor-advisory, x_refsource_REDHAT
- RHSA-2020:0773 vendor-advisory, x_refsource_REDHAT
- RHSA-2020:0730 vendor-advisory, x_refsource_REDHAT
- RHSA-2020:0731 vendor-advisory, x_refsource_REDHAT
- [debian-lts-announce] 20200316 [SECURITY] [DLA 2144-1] qemu security update mailing-list, x_refsource_MLIST
- openSUSE-SU-2020:0468 vendor-advisory, x_refsource_SUSE
- GLSA-202005-02 vendor-advisory, x_refsource_GENTOO
- [debian-lts-announce] 20200913 [SECURITY] [DLA 2373-1] qemu security update mailing-list, x_refsource_MLIST