An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0.

Published 6 y ago 2019-12-31 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.1 · NVD

CISA KEV

not known exploited

EPSS

3.4%

percentile 89%

Public exploits

none known

An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system via a special SCSI_IOCTL_SEND_COMMAND. It hits an assertion that implies that the size of successful DMA transfers there must be a multiple of 512 (the size of a sector). NOTE: a member of the QEMU security team disputes the significance of this issue because a "privileged guest user has many ways to cause similar DoS effect, without triggering this assert.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago 2024-06-26

Exploit prediction (EPSS)

3.36% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:N/I:N/A:P`

Classification

Weakness

CWE-754 Improper Check for Unusual or Exceptional Conditions

References

lists.nongnu.org /archive/html/qemu-devel/2019-07/msg01651.html · x_refsource_MISC, x_transferred
lists.nongnu.org /archive/html/qemu-devel/2019-11/msg00597.html · x_refsource_MISC, x_transferred
lists.nongnu.org /archive/html/qemu-devel/2019-11/msg02165.html · x_refsource_MISC, x_transferred
mail-archive.com /qemu-devel%40nongnu.org/msg667396.html · x_refsource_MISC, x_transferred
lists.nongnu.org /archive/html/qemu-devel/2019-07/msg03869.html · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2019-20175
NVD: CVE-2019-20175

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.