Vulnerability CVE-2020-12829

Vulnerability Name:

CVE-2020-12829 (CCN-187771)

Assigned:

2020-06-22

Published:

2020-06-22

Updated:

2020-12-14

Summary:

In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service.

CVSS v3 Severity:

3.8 Low (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L)
3.3 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

6.2 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
5.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

4.9 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

CWE-190

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2020-12829

Source: CCN
Type: Red Hat Bugzilla - Bug 1808510
(CVE-2020-12829) - CVE-2020-12829 qemu: OOB read and write due to integer overflow in sm501_2d_operation() in hw/display/sm501.c

Source: MISC
Type: Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1808510

Source: XF
Type: UNKNOWN
qemu-cve202012829-dos(187771)

Source: CCN
Type: QEMU GIT Repository
sm501: Replace hand written implementation with pixman where possible

Source: UBUNTU
Type: Third Party Advisory
USN-4467-1

Source: DEBIAN
Type: Third Party Advisory
DSA-4760

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2020-12829

Vulnerable Configuration:

Configuration 1:

cpe:/a:qemu:qemu:*:*:*:*:*:*:*:* (Version <= 5.0.1)

Configuration 2:

cpe:/o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

OR cpe:/o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

OR cpe:/o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Configuration 3:

cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:qemu:qemu:5.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:7948	P	libmozjs-78-0-78.15.0-150400.1.10 on GA media (Moderate)	2023-06-12
oval:org.opensuse.security:def:3385	P	tpm2.0-tools-3.1.4-1.12 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:94497	P	aspell-0.60.8-3.3.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:95201	P	libavformat58_76-4.4-150400.1.13 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:99440	P	(Moderate)	2021-12-06
oval:org.opensuse.security:def:101914	P	Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP3) (Important)	2021-08-17
oval:org.opensuse.security:def:101210	P	libopenjpeg1-1.5.2-2.28 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:99639	P	(Important)	2021-06-01
oval:org.opensuse.security:def:38198	P	Security update for kvm (Important)	2021-04-23
oval:org.opensuse.security:def:40422	P	Security update for kvm (Important)	2021-04-23
oval:org.opensuse.security:def:111339	P	Security update for qemu (Important)	2021-04-23
oval:org.opensuse.security:def:44852	P	Security update for kvm (Important)	2021-04-23
oval:org.opensuse.security:def:30184	P	Security update for qemu (Important)	2021-04-22
oval:org.opensuse.security:def:55173	P	Security update for qemu (Important)	2021-04-22
oval:org.opensuse.security:def:82557	P	Security update for qemu (Important)	2021-04-22
oval:org.opensuse.security:def:55887	P	Security update for qemu (Important)	2021-04-22
oval:org.opensuse.security:def:29350	P	Security update for qemu (Important)	2021-04-22
oval:org.opensuse.security:def:83271	P	Security update for qemu (Important)	2021-04-22
oval:org.opensuse.security:def:56007	P	Security update for qemu (Important)	2021-04-22
oval:org.opensuse.security:def:30064	P	Security update for qemu (Important)	2021-04-22
oval:org.opensuse.security:def:83391	P	Security update for qemu (Important)	2021-04-22
oval:org.opensuse.security:def:45896	P	Security update for kvm (Important)	2021-04-20
oval:org.opensuse.security:def:41466	P	Security update for kvm (Important)	2021-04-20
oval:org.opensuse.security:def:34409	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:69631	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:59458	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:88414	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:84127	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:96856	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:10241	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:93194	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:8562	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:91901	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:102719	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:32898	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:66742	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:99046	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:23885	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:57430	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:86535	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:107876	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:9491	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:92689	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:125518	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:69830	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:99945	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:31152	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:59716	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:89113	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:84584	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:96857	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:73596	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:8740	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:92096	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:42061	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:33635	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:69037	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:99241	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:57894	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:87362	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:108580	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:51538	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:9690	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:92888	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:126689	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:5653	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:70201	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:31607	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:60232	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:89371	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:85616	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:96858	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:75810	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:8935	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:92291	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:117391	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:33893	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:69447	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:58721	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:88102	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:109385	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:51873	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:10061	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:93041	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:127086	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:70381	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:32071	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:64474	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:98851	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:23550	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:56975	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:86071	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:96029	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:9307	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:92490	P	Security update for qemu (Important)	2021-04-16
oval:org.opensuse.security:def:118481	P	Security update for qemu (Important)	2021-04-16

BACK