Description
In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in the ati_cursor_define() routine while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.
References (3)
Core 3
Core References
Patch x_refsource_misc
https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=aab0e2a661b2b6bf7915c0aefe807fb60d6d9d13
Issue Tracking, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1841136
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210205-0003/
Scores
CVSS v3
6.5
EPSS
0.0012
EPSS Percentile
30.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Details
CWE
CWE-125
Status
published
Products (1)
qemu/qemu
4.1.0
Published
Dec 31, 2020
Tracked Since
Feb 18, 2026