PT-2020-4100
CVE-2020-8608
·
تاريخ النشر
2020-02-06
·
تاريخ التحديث
2024-11-08
الوصف من
CVSS 2.0
6.8
متوسطةالمقاييسAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions:
libslirp version 4.1.0
QEMU version 4.2.0
Description:
The issue is related to a component of the Libslirp TCP-IP emulator, specifically the tcp subr.c library, which has an insufficient mechanism for checking the size of copied data. This allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem arises from the misuse of snprintf return values in the tcp subr.c file, leading to a buffer overflow in later code.
Recommendations:
For libslirp version 4.1.0, consider updating to a newer version that addresses the buffer overflow issue in the tcp subr.c library.
For QEMU version 4.2.0, update to a version that includes the fix for the libslirp component to prevent exploitation of the buffer overflow vulnerability.
As a temporary workaround, consider restricting access to the tcp subr.c component until a patch is available.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾