CVE-2021-20196

2021-05-2621:16:58

CWE-476

redhat

www.cve.org

cve-2021-20196

qemu

floppy disk emulator

null pointer dereference

denial of service

system availability

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

23.5%

JSON

A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

CNA Affected

[
  {
    "product": "qemu",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "vulnerable up to (including) qemu 5.2.0"
      }
    ]
  }
]