Base Score

LOW3.9

CVE-2020-29443

ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.

VectorLOCAL

Published Bycve@mitre.org

Published DateJan 26, 2021, 18:15

Weakness Type (CWE):CWE-125

CVSS Metrics

Base Score

3.9

Vector String

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L

Base Severity

LOW

Version

3.1

Attack Vector (AV)

LOCAL

Attack Complexity (AC)

HIGH

Privileges Required (PR)

HIGH

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

LOW

Integrity (I)

NONE

Availability (A)

LOW

References

http://www.openwall.com/lists/oss-security/2021/01/18/2
https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg04685.html
https://security.netapp.com/advisory/ntap-20210304-0003/

Base Score

LOW3.9

Weakness Type (CWE):CWE-125

CVSS Metrics

Base Score

3.9

Vector String

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L

Base Severity

LOW

Version

3.1

Attack Vector (AV)

LOCAL

Attack Complexity (AC)

HIGH

Privileges Required (PR)

HIGH

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

LOW

Integrity (I)

NONE

Availability (A)

LOW