CVE-2020-27616
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a...
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.
- Record
CVE-2020-27616- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-682
- Updated
- 2026-11-02
CVE List No score
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.
- Record
CVE-2020-27616- Updated
- 2026-11-02
EUVDEUVD-2020-20123 No score
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.
- Record
EUVD-2020-20123- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7r3q-28jv-xmcr No score
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a...
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.
- Record
GHSA-7r3q-28jv-xmcr- Weakness
- CWE-682
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-27616
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.
- Record
ALPINE-CVE-2020-27616- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2020-27616
CVE-2020-27616 does not affect BellSoft software
- Record
BELL-CVE-2020-27616- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSV
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.
- Record
CVE-2020-27616- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-27616
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.
- Record
DEBIAN-CVE-2020-27616- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-27616
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.
- Record
UBUNTU-CVE-2020-27616- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0600-1 No score
Security update for qemu
This update for qemu fixes the following issues:
- CVE-2020-12829: Fix OOB access in sm501 device emulation (bsc#1172385)
- CVE-2020-25723: Fix use-after-free in usb xhci packet handling (bsc#1178934)
- CVE-2020-25084: Fix use-after-free in usb ehci packet handling (bsc#1176673)
- CVE-2020-25625: Fix infinite loop (DoS) in usb hcd-ohci emulation (bsc#1176684)
- CVE-2020-25624: Fix OOB access in usb hcd-ohci emulation (bsc#1176682)
- CVE-2020-27617: Fix guest triggerable assert in shared network handling code (bsc#1178174)
- CVE-2020-28916: Fix infinite loop (DoS) in e1000e device emulation (bsc#1179468)
- CVE-2020-29443: Fix OOB access in atapi emulation (bsc#1181108)
- CVE-2020-27821: Fix heap overflow in MSIx emulation (bsc#1179686)
- CVE-2020-15469: Fix null pointer deref. (DoS) in mmio ops (bsc#1173612)
- CVE-2021-20257: Fix infinite loop (DoS) in e1000 device emulation (bsc#1182577)
- CVE-2021-3416: Fix OOB access (stack overflow) in rtl8139 NIC emulation (bsc#1182968)
- CVE-2021-3416: Fix OOB access (stack overflow) in other NIC emulations (bsc#1182968)
- CVE-2020-27616: Fix OOB access in ati-vga emulation (bsc#1178400)
- CVE-2020-29129: Fix OOB access in SLIRP ARP/NCSI packet processing (bsc#1179466, CVE-2020-29130, bsc#1179467)
- Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
- Add split-provides through forsplits/13 to cover updates of SLE15-SP2 to SLE15-SP3, and openSUSE equivalents (bsc#1184064)
- Added a few more usability improvements for our git packaging workflow
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:0600-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1243-1 No score
Security update for qemu
This update for qemu fixes the following issues:
- CVE-2020-12829: Fix OOB access in sm501 device emulation (bsc#1172385)
- CVE-2020-25723: Fix use-after-free in usb xhci packet handling (bsc#1178934)
- CVE-2020-25084: Fix use-after-free in usb ehci packet handling (bsc#1176673)
- CVE-2020-25625: Fix infinite loop (DoS) in usb hcd-ohci emulation (bsc#1176684)
- CVE-2020-25624: Fix OOB access in usb hcd-ohci emulation (bsc#1176682)
- CVE-2020-27617: Fix guest triggerable assert in shared network handling code (bsc#1178174)
- CVE-2020-28916: Fix infinite loop (DoS) in e1000e device emulation (bsc#1179468)
- CVE-2020-29443: Fix OOB access in atapi emulation (bsc#1181108)
- CVE-2020-27821: Fix heap overflow in MSIx emulation (bsc#1179686)
- CVE-2020-15469: Fix null pointer deref. (DoS) in mmio ops (bsc#1173612)
- CVE-2021-20257: Fix infinite loop (DoS) in e1000 device emulation (bsc#1182577)
- CVE-2021-3416: Fix OOB access (stack overflow) in rtl8139 NIC emulation (bsc#1182968)
- CVE-2021-3416: Fix OOB access (stack overflow) in other NIC emulations (bsc#1182968)
- CVE-2020-27616: Fix OOB access in ati-vga emulation (bsc#1178400)
- CVE-2020-29129: Fix OOB access in SLIRP ARP/NCSI packet processing (bsc#1179466, CVE-2020-29130, bsc#1179467)
- Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
- Add split-provides through forsplits/13 to cover updates of SLE15-SP2 to SLE15-SP3, and openSUSE equivalents (bsc#1184064)
- Added a few more usability improvements for our git packaging workflow
- Record
SUSE-SU-2021:1243-1- Updated
- 2026-11-02
OSVUSN-4650-1 No score
qemu vulnerabilities
Alexander Bulekov discovered that QEMU incorrectly handled SDHCI device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2020-17380)
Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that QEMU incorrectly handled USB device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-25084)
Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that QEMU incorrectly handled SDHCI device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-25085)
Gaoning Pan, Yongkang Jia, and Yi Ren discovered that QEMU incorrectly handled USB device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-25624)
It was discovered that QEMU incorrectly handled USB device emulation. An attacker inside the guest could use this issue to cause QEMU to hang, resulting in a denial of service. (CVE-2020-25625)
Cheolwoo Myung discovered that QEMU incorrectly handled USB device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-25723)
Gaoning Pan discovered that QEMU incorrectly handled ATI graphics device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2020-27616)
Gaoning Pan discovered that QEMU incorrectly handled networking. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-27617)
- Record
USN-4650-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuAlpine:v3.16 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.17 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.18 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.19 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.20 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.21 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.22 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.23 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuAlpine:v3.24 |
before 5.0.0-r0 | 5.0.0-r0 |
qemuDebian:12 |
before 1:5.2+dfsg-1 | 1:5.2+dfsg-1 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qemuDebian:13 |
before 1:5.2+dfsg-1 | 1:5.2+dfsg-1 |
qemuDebian:14 |
before 1:5.2+dfsg-1 | 1:5.2+dfsg-1 |
qemuSUSE:Linux Enterprise Module for Basesystem 15 SP2 From an advisory covering 15 CVEs |
before 4.2.1-11.16.3 | 4.2.1-11.16.3 |
qemuSUSE:Linux Enterprise Module for Server Applications 15 SP2 From an advisory covering 15 CVEs |
before 4.2.1-11.16.3 | 4.2.1-11.16.3 |
qemuSUSE:Linux Enterprise Micro 5.0 From an advisory covering 15 CVEs |
before 4.2.1-11.16.3 | 4.2.1-11.16.3 |
qemuUbuntu:20.04:LTS |
before 1:4.2-3ubuntu6.10, plus listed versions 1:4.0+dfsg-0ubuntu91:4.0+dfsg-0ubuntu101:4.2-1ubuntu11:4.2-1ubuntu21:4.2-3ubuntu1 Show 14 moreShow less1:4.2-3ubuntu21:4.2-3ubuntu31:4.2-3ubuntu41:4.2-3ubuntu51:4.2-3ubuntu61:4.2-3ubuntu6.11:4.2-3ubuntu6.21:4.2-3ubuntu6.31:4.2-3ubuntu6.41:4.2-3ubuntu6.51:4.2-3ubuntu6.61:4.2-3ubuntu6.71:4.2-3ubuntu6.81:4.2-3ubuntu6.9 |
1:4.2-3ubuntu6.10 |
qemuUbuntu:16.04:LTS From an advisory covering 8 CVEs |
before 1:2.5+dfsg-5ubuntu10.48, plus listed versions 1:2.3+dfsg-5ubuntu91:2.3+dfsg-5ubuntu101:2.4+dfsg-4ubuntu11:2.4+dfsg-4ubuntu21:2.4+dfsg-4ubuntu3 Show 45 moreShow less1:2.4+dfsg-5ubuntu31:2.5+dfsg-1ubuntu21:2.5+dfsg-1ubuntu31:2.5+dfsg-1ubuntu41:2.5+dfsg-1ubuntu51:2.5+dfsg-5ubuntu11:2.5+dfsg-5ubuntu21:2.5+dfsg-5ubuntu41:2.5+dfsg-5ubuntu61:2.5+dfsg-5ubuntu71:2.5+dfsg-5ubuntu101:2.5+dfsg-5ubuntu10.11:2.5+dfsg-5ubuntu10.21:2.5+dfsg-5ubuntu10.31:2.5+dfsg-5ubuntu10.41:2.5+dfsg-5ubuntu10.51:2.5+dfsg-5ubuntu10.61:2.5+dfsg-5ubuntu10.71:2.5+dfsg-5ubuntu10.81:2.5+dfsg-5ubuntu10.91:2.5+dfsg-5ubuntu10.101:2.5+dfsg-5ubuntu10.111:2.5+dfsg-5ubuntu10.131:2.5+dfsg-5ubuntu10.141:2.5+dfsg-5ubuntu10.151:2.5+dfsg-5ubuntu10.161:2.5+dfsg-5ubuntu10.201:2.5+dfsg-5ubuntu10.211:2.5+dfsg-5ubuntu10.221:2.5+dfsg-5ubuntu10.241:2.5+dfsg-5ubuntu10.251:2.5+dfsg-5ubuntu10.261:2.5+dfsg-5ubuntu10.281:2.5+dfsg-5ubuntu10.291:2.5+dfsg-5ubuntu10.301:2.5+dfsg-5ubuntu10.311:2.5+dfsg-5ubuntu10.321:2.5+dfsg-5ubuntu10.331:2.5+dfsg-5ubuntu10.341:2.5+dfsg-5ubuntu10.351:2.5+dfsg-5ubuntu10.361:2.5+dfsg-5ubuntu10.371:2.5+dfsg-5ubuntu10.381:2.5+dfsg-5ubuntu10.391:2.5+dfsg-5ubuntu10.40 |
1:2.5+dfsg-5ubuntu10.48 |
qemuUbuntu:18.04:LTS From an advisory covering 8 CVEs |
before 1:2.11+dfsg-1ubuntu7.34, plus listed versions 1:2.10+dfsg-0ubuntu31:2.10+dfsg-0ubuntu41:2.10+dfsg-0ubuntu51:2.11+dfsg-1ubuntu11:2.11+dfsg-1ubuntu2 Show 33 moreShow less1:2.11+dfsg-1ubuntu41:2.11+dfsg-1ubuntu51:2.11+dfsg-1ubuntu61:2.11+dfsg-1ubuntu71:2.11+dfsg-1ubuntu7.11:2.11+dfsg-1ubuntu7.21:2.11+dfsg-1ubuntu7.31:2.11+dfsg-1ubuntu7.41:2.11+dfsg-1ubuntu7.51:2.11+dfsg-1ubuntu7.61:2.11+dfsg-1ubuntu7.71:2.11+dfsg-1ubuntu7.81:2.11+dfsg-1ubuntu7.91:2.11+dfsg-1ubuntu7.101:2.11+dfsg-1ubuntu7.121:2.11+dfsg-1ubuntu7.131:2.11+dfsg-1ubuntu7.141:2.11+dfsg-1ubuntu7.151:2.11+dfsg-1ubuntu7.171:2.11+dfsg-1ubuntu7.181:2.11+dfsg-1ubuntu7.191:2.11+dfsg-1ubuntu7.201:2.11+dfsg-1ubuntu7.211:2.11+dfsg-1ubuntu7.221:2.11+dfsg-1ubuntu7.231:2.11+dfsg-1ubuntu7.251:2.11+dfsg-1ubuntu7.261:2.11+dfsg-1ubuntu7.271:2.11+dfsg-1ubuntu7.281:2.11+dfsg-1ubuntu7.291:2.11+dfsg-1ubuntu7.311:2.11+dfsg-1ubuntu7.321:2.11+dfsg-1ubuntu7.33 |
1:2.11+dfsg-1ubuntu7.34 |
qemuUbuntu:20.04:LTS From an advisory covering 8 CVEs |
before 1:4.2-3ubuntu6.10, plus listed versions 1:4.0+dfsg-0ubuntu91:4.0+dfsg-0ubuntu101:4.2-1ubuntu11:4.2-1ubuntu21:4.2-3ubuntu1 Show 14 moreShow less1:4.2-3ubuntu21:4.2-3ubuntu31:4.2-3ubuntu41:4.2-3ubuntu51:4.2-3ubuntu61:4.2-3ubuntu6.11:4.2-3ubuntu6.21:4.2-3ubuntu6.31:4.2-3ubuntu6.41:4.2-3ubuntu6.51:4.2-3ubuntu6.61:4.2-3ubuntu6.71:4.2-3ubuntu6.81:4.2-3ubuntu6.9 |
1:4.2-3ubuntu6.10 |
qemuopenSUSE:Leap 15.2 From an advisory covering 15 CVEs |
before 4.2.1-lp152.9.12.1 | 4.2.1-lp152.9.12.1 |
qemu-linux-useropenSUSE:Leap 15.2 From an advisory covering 15 CVEs |
before 4.2.1-lp152.9.12.1 | 4.2.1-lp152.9.12.1 |
qemu-testsuiteopenSUSE:Leap 15.2 From an advisory covering 15 CVEs |
before 4.2.1-lp152.9.12.1 | 4.2.1-lp152.9.12.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-27616 is a medium vulnerability (CVSS 6.5) in Qemu, published November 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.53%, the 84th percentile. Fixed in qemu 5.0.0-r0.
References
lists.nongnu.org/archive/html/qemu-devel/2020-10/msg05018.html
openwall.com/lists/oss-security/2020/11/03/2
security.netapp.com/advisory/ntap-20201202-0002
nvd.nist.gov/vuln/detail/CVE-2020-27616
github.com/advisories/GHSA-7r3q-28jv-xmcr
security.alpinelinux.org/vuln/CVE-2020-27616
Show 47 moreShow less
docs.bell-sw.com/security/cves/CVE-2020-27616
security-tracker.debian.org/tracker/CVE-2020-27616
suse.com/support/update/announcement/2021/suse-su-20211243-1
bugzilla.suse.com/1172385
ubuntu.com/security/CVE-2020-27616
cve.org/CVERecord?id=CVE-2020-27616
lists.opensuse.org/archives/list/[email protected]/thread/ATYM36RK6JXDXZ33F2KFHZHDZ3F3YD24
Left out here: 7 versions. The JSON record has them.