CVE-2020-13361

Name of the Vulnerable Software and Affected Versions QEMU versions 4.2.0 through 5.0.0

Description The issue is related to a buffer data boundary operation overflow. It allows an attacker to compromise data integrity and cause a denial of service. The problem lies in the es1370 transfer audio function in hw/audio/es1370.c, which does not properly validate the frame count. This allows guest OS users to trigger an out-of-bounds access during an es1370 write() operation.

Recommendations For QEMU versions 4.2.0 through 5.0.0, consider disabling the es1370 transfer audio function until a patch is available to prevent out-of-bounds access during es1370 write() operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.