CVE-2020-14364

MEDIUM

QEMU < 5.2.0 - Out-of-bounds Read/Write in USB Emulator

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2020-14364. PoCs published by gejian-iscas, y-f00l.

AI-analyzed exploit summary This PoC exploits CVE-2020-14364, a memory leak vulnerability in the Linux kernel's USB subsystem, to leak kernel memory addresses. It uses MMIO operations and USB device manipulation to trigger the vulnerability and extract sensitive information.

Description

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.

Exploits (2)

nomisec WORKING POC 2 stars

by gejian-iscas · poc

https://github.com/gejian-iscas/CVE-2020-14364

View Code ZIP pw:eip

This PoC exploits CVE-2020-14364, a memory leak vulnerability in the Linux kernel's USB subsystem, to leak kernel memory addresses. It uses MMIO operations and USB device manipulation to trigger the vulnerability and extract sensitive information.

Classification

Working Poc 90%

Attack Type

Info Leak

Complexity

Complex

Reliability

Reliable

Target: Linux kernel (specific version not specified)

No auth needed

Prerequisites: Access to the target system's USB subsystem · Ability to execute code with sufficient privileges to perform MMIO operations

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1082 - System Information Discovery

mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

nomisec WORKING POC 1 stars

by y-f00l · poc

https://github.com/y-f00l/CVE-2020-14364

View Code ZIP pw:eip

This is a Linux kernel module exploit for CVE-2020-14364, targeting a use-after-free vulnerability in the UHCI USB controller emulation in QEMU. The exploit leverages DMA operations to achieve arbitrary read/write primitives and ultimately executes a system() call via a fake timer structure.