NVD Vulnerability Detail

CVE-2020-10761

Summary	An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server resulting in a denial of service.
Publication Date	June 9, 2020, 10:15 p.m.
Registration Date	Jan. 26, 2021, 11:50 a.m.
Last Update	Nov. 21, 2024, 1:56 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:qemu:qemu::::::::					5.0.1

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
cpe:2.3:o:redhat:enterprise_linux:8.0::::advanced_virtualization:::

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:15.2:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html	Mailing List Third Party Advisory
2	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10761	Issue Tracking Third Party Advisory
3	https://security.gentoo.org/glsa/202011-09	Third Party Advisory
4	https://security.netapp.com/advisory/ntap-20200731-0001/	Third Party Advisory
5	https://usn.ubuntu.com/4467-1/	Third Party Advisory
6	https://www.openwall.com/lists/oss-security/2020/06/09/1	Mailing List Patch Third Party Advisory
7	http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html	Mailing List Third Party Advisory
8	https://www.openwall.com/lists/oss-security/2020/06/09/1	Mailing List Patch Third Party Advisory
9	https://usn.ubuntu.com/4467-1/	Third Party Advisory
10	https://security.netapp.com/advisory/ntap-20200731-0001/	Third Party Advisory
11	https://security.gentoo.org/glsa/202011-09	Third Party Advisory
12	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10761	Issue Tracking Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-617	到達可能なアサーション	https://cwe.mitre.org/data/definitions/617.html

JVN Vulnerability Information

QEMU における到達可能なアサーションに関する脆弱性

Title	QEMU における到達可能なアサーションに関する脆弱性
Summary	QEMU には、到達可能なアサーションに関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 3, 2020, midnight
Registration Date	July 20, 2020, 2:04 p.m.
Last Update	July 20, 2020, 2:04 p.m.

Affected System

レッドハット

Red Hat Enterprise Linux

Fabrice Bellard

QEMU 5.0.1 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-10761	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10761
National Vulnerability Database (NVD)
2	CVE-2020-10761	https://nvd.nist.gov/vuln/detail/CVE-2020-10761
関連文書
3	CVE-2020-10761 QEMU: nbd: reachable assertion failure innbd_negotiate_send_rep_verr via remote client	https://www.openwall.com/lists/oss-security/2020/06/09/1

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-617	http://cwe.mitre.org/data/definitions/617.html

ベンダー情報

No	Name	URL
QEMU
1	Top Page	https://lists.gnu.org/
Red Hat Bugzilla
2	Bug 1843707	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10761

Change Log

No	Changed Details	Date of change
1	[2020年07月20日] 掲載	July 20, 2020, 2:04 p.m.