CVE-2020-12829

In QEMU through 5.0.0, an integer overflow was found in the SM501 display
driver implementation. This flaw occurs in the COPY_AREA macro while
handling MMIO write operations through the sm501_2d_engine_write()
callback. A local attacker could abuse this flaw to crash the QEMU process
in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a
denial of service.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=961451&gt;
• <https://bugzilla.redhat.com/show_bug.cgi?id=1808510&gt;
• <https://bugzilla.redhat.com/show_bug.cgi?id=1786026&gt;