Bug 1176810 – VUL-1: CVE-2020-25741: kvm,qemu: fdc: null pointer dereference during r/w data transfer

Bug 1176810 - (CVE-2020-25741) VUL-1: CVE-2020-25741: kvm,qemu: fdc: null pointer dereference during r/w data transfer

(CVE-2020-25741)
Summary:	VUL-1: CVE-2020-25741: kvm,qemu: fdc: null pointer dereference during r/w dat...

Status:	RESOLVED WONTFIX

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P4 - Low Severity: Normal
Target Milestone:	---
Assigned To:	Dario Faggioli
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/268006/
Whiteboard:	CVSSv3.1:SUSE:CVE-2020-25741:4.4:(AV:...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2020-09-22 13:08 UTC by Wolfgang Frisch
Modified:	2023-03-08 04:23 UTC (History)
CC List:	6 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Wolfgang Frisch 2020-09-22 13:08:20 UTC

CVE-2020-25741:

A null pointer dereference issue was found in the Floppy disk emulator of QEMU. It could occur while transferring data via fdctrl_read_data(), fdctrl_write_data() routines, if current drive has a null block pointer. A guest may use this flaw to crash the QEMU process on the host resulting in DoS scenario.

References:
https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg07779.html
https://bugzilla.redhat.com/show_bug.cgi?id=1881401
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25741

Comment 1 Wolfgang Frisch 2020-09-22 13:14:41 UTC

Affects all supported code streams.
The code in qemu-1.4.2 and older is slightly different, but also lacks the null pointer check.

Comment 4 Dario Faggioli 2023-03-07 22:17:11 UTC

This issue is rather old, and the proposed patch never made it upstream, nor it was replaced/superseeded by any other one (i.e., the upstream code is still there and still look the same way as it was looking back then, without this patch).

Shall we close it?