Security Advisory - QEMU Out-of-bound Read and Write Vulnerability in Huawei Product

An out-of-bound read and write access vulnerability was found in the USB emulator of the QEMU. It occurs while processing USB packets from a guest. Attackers can use this vulnerability to crash the QEMU process resulting in DoS or potentially execute arbitrary code with the privileges of the QEMU process on the host. This can compromise normal service of the affected product. (Vulnerability ID: HWPSIRT-2020-61105) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-14364.

Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-qemu-en