The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.

🗓️ 30 Mar 2021 07:00:00Reported by MicrosoftType

Patch ineffective for SDHCI flaw; QEMU vulnerable through privileged guests to out-of-bounds access.

Reporter	Title	Published	Views	Family All 179
AlpineLinux	CVE-2020-17380	30 Jan 202105:38	–	alpinelinux
AlpineLinux	CVE-2020-25085	25 Sep 202004:09	–	alpinelinux
AlpineLinux	CVE-2021-3409	23 Mar 202120:20	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in Qemu	3 May 202623:59	–	astralinux
AstraLinux	Astra Linux - уязвимость в qemu	20 May 202605:53	–	astralinux
AstraLinux	Astra Linux - уязвимость в qemu	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the sdhci_sdma_transfer_multi_blocks() procedure in the QEMU hardware emulation software allows a attacker to cause a service failure or an unexpected termination of the application. Additionally, it enables the execution of arbitrary code.	21 Apr 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the flatview_read_continue() module of the QEMU hardware emulation software lies in the ability to write beyond the buffer boundaries. This allows attackers to access confidential data, compromise its integrity, and cause service failures.	27 Oct 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the QEMU hardware emulation software, related to the issue of writing operations beyond the buffer boundaries in memory, allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.	21 Sep 202200:00	–	bdu_fstec
CBLMariner	CVE-2020-17380 affecting package qemu-kvm 4.2.0-48	3 Mar 202103:44	–	cbl_mariner