Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2020-11947

Good to know:

icon

Date: December 30, 2020

iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker. After conducting further research, Mend has determined that all versions of qemu up to version v5.0.0 are vulnerable to CVE-2020-11947.

Language: C

Severity Score

Related Resources (9)

https://security-tracker.debian.org/tracker/CVE-2020-11947
http://www.openwall.com/lists/oss-security/2021/01/13/4
https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ff0507c239a246fd7215b31c5658fc6a3ee1e4c5
https://security.netapp.com/advisory/ntap-20210212-0001/
https://people.canonical.com/~ubuntu-security/cve/CVE-2020-11947
https://git.qemu.org/?p=qemu.git;a=commit;h=ff0507c239a246fd7215b31c5658fc6a3ee1e4c5
https://nvd.nist.gov/vuln/detail/CVE-2020-11947
https://access.redhat.com/security/cve/CVE-2020-11947
https://www.mend.io/vulnerability-database/CVE-2020-11947

Severity Score

Weakness Type (CWE)

Out-of-bounds Read

CWE-125

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): LOCAL
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us