CVE-2020-27661
Description
A divide-by-zero flaw was found in QEMU in the dwc-hsotg (dwc2) USB host controller emulation. More specifically, HCCHAR_MPS was read from a device register and later used as a divisor without performing a sanity check. This flaw allows a malicious or buggy guest to crash the QEMU process on the host, resulting in a denial of service.
Statement
This flaw did not affect the following versions of QEMU as they did not include support for dwc2 USB host controller emulation:
qemu-kvm-maas shipped with Red Hat Enterprise Linux 7.qemu-kvm-rhevas shipped with Red Hat Virtualization and Red Hat OpenStack.qemu-kvmas shipped with Red Hat Enterprise Linux 6, 7, 8, and RHEL Advanced Virtualization.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.8 | 6.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Changed | Changed | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | Low | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
A Divide by Zero results in a crash.
Acknowledgements
Red Hat would like to thank Gaoning Pan (Ant Security Light-Year Lab) and Xingwei Lin (Ant Security Light-Year Lab) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
