Vulnerabilities > CVE-2020-35505 - NULL Pointer Dereference vulnerability in multiple products
Attack vector
LOCAL Attack complexity
LOW Privileges required
HIGH Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | Qemu
| 67 |
| OS | 1 |
Common Weakness Enumeration (CWE)
References
- http://www.openwall.com/lists/oss-security/2021/04/16/3
- http://www.openwall.com/lists/oss-security/2021/04/16/3
- https://bugzilla.redhat.com/show_bug.cgi?id=1909769
- https://bugzilla.redhat.com/show_bug.cgi?id=1909769
- https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
- https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
- https://security.gentoo.org/glsa/202208-27
- https://security.gentoo.org/glsa/202208-27
- https://security.netapp.com/advisory/ntap-20210713-0006/
- https://security.netapp.com/advisory/ntap-20210713-0006/
- https://www.openwall.com/lists/oss-security/2021/04/16/3
- https://www.openwall.com/lists/oss-security/2021/04/16/3