CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
4.8 | $0-$5k | 0.00 |
A vulnerability, which was classified as problematic, has been found in QEMU (Virtualization Software) (the affected version unknown). This issue affects the function eth_get_gso_type
of the component Networking Helper. The manipulation with an unknown input leads to a assertion vulnerability. Using CWE to declare the problem leads to CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. Impacted is availability.
The weakness was shared 10/21/2020. It is possible to read the advisory at seclists.org. The identification of this vulnerability is CVE-2020-27617. Technical details of the vulnerability are known, but there is no available exploit.
Applying a patch is able to eliminate this problem. The bugfix is ready for download at lists.nongnu.org. A possible mitigation has been published immediately after the disclosure of the vulnerability.
Product
Type
Name
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.0VulDB Meta Temp Score: 4.9
VulDB Base Score: 3.5
VulDB Temp Score: 3.4
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 6.5
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: AssertionCWE: CWE-617
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Partially
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Patch: lists.nongnu.org
Timeline
10/21/2020 🔍10/21/2020 🔍
10/22/2020 🔍
11/04/2020 🔍
12/02/2020 🔍
Sources
Product: qemu.orgAdvisory: seclists.org
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2020-27617 (🔍)
Entry
Created: 11/04/2020 13:28Updated: 12/02/2020 00:56
Changes: 11/04/2020 13:28 (38), 12/02/2020 00:52 (3), 12/02/2020 00:56 (18)
Complete: 🔍
Submitter: CSieberg
Submit
Accepted
- Submit #2065: CVE-2020-27617 QEMU (by CSieberg)
No comments yet. Languages: en.
Please log in to comment.