CVE-2020-35505

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	QEMU	qemu 6.0.0

References

http://www.openwall.com/lists/oss-security/2021/04/16/3Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1909769Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202208-27Third Party Advisory
https://security.netapp.com/advisory/ntap-20210713-0006/Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/04/16/3Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/04/16/3Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1909769Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202208-27Third Party Advisory
https://security.netapp.com/advisory/ntap-20210713-0006/Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/04/16/3Mailing List, Patch, Third Party Advisory

Timeline

Published: May 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-355066.7A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handlin CVE-2020-355075.5There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able CVE-2020-355084.5A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process ident CVE-2020-355095.4A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticato CVE-2020-35516.1A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke CVE-2020-355105.9A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever i CVE-2020-355117.8A global buffer overflow was discovered in pngcheck function in pngcheck-2.4.0(5 patches applied) via a crafted png file.CVE-2020-355127.8A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older bran CVE-2020-355134.9A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system) functionality was found in the wa CVE-2020-355147.0An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a r CVE-2020-355178.2A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest us CVE-2020-355185.3When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used