CVE-2020-13754

Name of the Vulnerable Software and Affected Versions QEMU version 4.2.0

Description The issue is related to a buffer data boundary operation overflow in QEMU, which can be exploited to access confidential data, compromise data integrity, and cause a denial of service. Specifically, the hw/pci/msix.c file in QEMU allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.

Recommendations For QEMU version 4.2.0, consider restricting access to the hw/pci/msix.c file or the msi-x mmio operation to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.