CVE-2020-1711CWE-122

An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an…

High · published February 11, 2020

CVSS v3.1
7.7
EPSS
4%
Percentile
90.5
In the wild
Unconfirmed
What it is

An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.04018 · 90.5th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2020-02-11T19:42Z
EPSS history
Timeline
  • 11 FEB 19:42Z
    An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an…
    cvelistv5