CVE-2020-25624

A flaw was found in QEMU. An out-of-bounds read/write access issue was found in the USB OHCI controller emulator. This issue occurs while servicing transfer descriptors (TD), as the OHCI controller derives variables ‘start_addr’, ‘end_addr’, and ‘len’ from values supplied by the host controller driver. The host controller driver may supply values when using these variables, leading to an out-of-bounds access issue. This flaw allows a guest user or process to crash the QEMU process on the host, resulting in a denial of service.