hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host resulting in a denial of service or potential privileged code execution. This was fixed in commit 5519724a13664b43e225ca05351c60b4468e4555.

🗓️ 18 Aug 2020 07:00:00Reported by MicrosoftType

XGMAC buffer overflow in QEMU during packet transmission on highbank and midway; could crash host.

Reporter	Title	Published	Views	Family All 99
AlpineLinux	CVE-2020-15863	28 Jul 202015:40	–	alpinelinux
BDU FSTEC	The vulnerability of the xgmac_enet_send function in the hw/net/xgmac.c file of the QEMU hardware emulation software arises from a lack of mechanism for checking the size of copied data. This allows a malicious actor to gain access to protected information, compromise its integrity, and cause service failures.	23 Dec 202000:00	–	bdu_fstec
CBLMariner	CVE-2020-15863 affecting package qemu-kvm 4.2.0-48	5 Nov 202004:21	–	cbl_mariner
CNVD	QEMU Buffer Overflow Vulnerability (CNVD-2020-44638)	5 Aug 202000:00	–	cnvd
CVE	CVE-2020-15863	28 Jul 202015:40	–	cve
Cvelist	CVE-2020-15863	28 Jul 202015:40	–	cvelist
Debian	[SECURITY] [DLA 2288-1] qemu security update	26 Jul 202011:51	–	debian
Debian	[SECURITY] [DSA 4760-1] qemu security update	6 Sep 202018:00	–	debian
Debian CVE	CVE-2020-15863	28 Jul 202015:40	–	debiancve
Tenable Nessus	Debian DLA-2288-1 : qemu security update	27 Jul 202000:00	–	nessus