Base Score

LOW3.2

CVE-2020-25742

pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.

VectorLOCAL

Published Bycve@mitre.org

Published DateOct 06, 2020, 15:15

Weakness Type (CWE):CWE-476

CVSS Metrics

Base Score

3.2

Vector String

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L

Base Severity

LOW

Version

3.1

Attack Vector (AV)

LOCAL

Attack Complexity (AC)

LOW

Privileges Required (PR)

HIGH

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

NONE

Integrity (I)

NONE

Availability (A)

LOW

References

http://www.openwall.com/lists/oss-security/2020/09/29/1
https://bugzilla.redhat.com/show_bug.cgi?id=1883178
https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05294.html
https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Flsi_nullptr1

Base Score

LOW3.2

Weakness Type (CWE):CWE-476

CVSS Metrics

Base Score

3.2

Vector String

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L

Base Severity

LOW

Version

3.1

Attack Vector (AV)

LOCAL

Attack Complexity (AC)

LOW

Privileges Required (PR)

HIGH

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

NONE

Integrity (I)

NONE

Availability (A)

LOW