Bugzilla – Bug 1173109
VUL-1: CVE-2020-14415: qemu: division by zero in oss_write() in audio/ossaudio.c
Last modified: 2021-04-09 14:53:47 UTC
A divide-by-zero flaw was found in function oss_write() in audio/ossaudio.c, resulting in a possible crash and denial of service scenario.
The bug was introduced by this commit:
>Mon, 23 Sep 2019 12:28:47 +0200
>ossaudio: port to the new audio backend api
Fix is queued for first SLE15-SP2 maintenance update.
Note about this fix's inclusion:
At the time the patch was included in the SLE15-SP2 package (see Mar 12, 2020 mention of audio-oss-fix-buffer-pos-calculation.patch in qemu.changes file), this bug report hadn't been created yet.
The patch was removed, since it is now part of the v4.2.1 stable release.
Fixed in all affected code streams. Reassigning bug back to security-team.