CVE-2020-35506
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU...
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.
- Record
CVE-2020-35506- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.
- Record
CVE-2020-35506- Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2020-23175 No score
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.
- Record
EUVD-2020-23175- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qfjc-pj3q-qmpf
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU...
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.
- Record
GHSA-qfjc-pj3q-qmpf- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-35506
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.
- Record
ALPINE-CVE-2020-35506- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2020-35506
CVE-2020-35506 does not affect BellSoft software
- Record
BELL-CVE-2020-35506- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 13 moreShow less
OSV
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.
- Record
CVE-2020-35506- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-35506
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process.
- Record
DEBIAN-CVE-2020-35506- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1202-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- CVE-2021-3527: usb: unbounded stack allocation in usbredir (bsc#1186012)
- CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
- CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
- CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
- CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
- CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
- CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
- CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
- CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
- CVE-2021-3682: usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145)
- CVE-2020-35503: NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432)
- CVE-2020-35504,CVE-2020-35505,CVE-2020-35506: NULL pointer dereference in ESP (bsc#1180433 bsc#1180434 bsc#1180435)
- CVE-2021-20255: eepro100: stack overflow via infinite recursion (bsc#1182651)
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:1202-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:2789-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
- Record
openSUSE-SU-2021:2789-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:2858-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
Non-security issues fixed:
- Use max host physical address if -cpu max is used (bsc#1188299)
- Record
openSUSE-SU-2021:2858-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:3614-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
- Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
Non-security issues fixed:
- Use max host physical address if -cpu max is used (bsc#1188299)
- Record
openSUSE-SU-2021:3614-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2789-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
- Record
SUSE-SU-2021:2789-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2813-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
- Record
SUSE-SU-2021:2813-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2858-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
Non-security issues fixed:
- Use max host physical address if -cpu max is used (bsc#1188299)
- Record
SUSE-SU-2021:2858-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3575-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
- Record
SUSE-SU-2021:3575-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3613-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)
- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
- Record
SUSE-SU-2021:3613-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3614-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
- Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
Non-security issues fixed:
- Use max host physical address if -cpu max is used (bsc#1188299)
- Record
SUSE-SU-2021:3614-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3635-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)
- Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
- usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
- NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
- NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
- eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
- usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)
- Record
SUSE-SU-2021:3635-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuAlpine:v3.16 |
before 6.0.0-r2 | 6.0.0-r2 |
qemuAlpine:v3.17 |
before 6.0.0-r2 | 6.0.0-r2 |
qemuAlpine:v3.18 |
before 6.0.0-r2 | 6.0.0-r2 |
qemuAlpine:v3.19 |
before 6.0.0-r2 | 6.0.0-r2 |
qemuAlpine:v3.20 |
before 6.0.0-r2 | 6.0.0-r2 |
qemuAlpine:v3.21 |
before 6.0.0-r2 | 6.0.0-r2 |
qemuAlpine:v3.22 |
before 6.0.0-r2 | 6.0.0-r2 |
qemuAlpine:v3.23 |
before 6.0.0-r2 | 6.0.0-r2 |
qemuAlpine:v3.24 |
before 6.0.0-r2 | 6.0.0-r2 |
qemuDebian:12 |
before 1:6.0+dfsg-3 | 1:6.0+dfsg-3 |
Show 30 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qemuDebian:13 |
before 1:6.0+dfsg-3 | 1:6.0+dfsg-3 |
qemuDebian:14 |
before 1:6.0+dfsg-3 | 1:6.0+dfsg-3 |
qemuSUSE:Linux Enterprise Module for Basesystem 15 SP2 From an advisory covering 7 CVEs |
before 4.2.1-11.28.1 | 4.2.1-11.28.1 |
qemuSUSE:Linux Enterprise Module for Server Applications 15 SP2 From an advisory covering 7 CVEs |
before 4.2.1-11.28.1 | 4.2.1-11.28.1 |
qemuSUSE:Linux Enterprise Micro 5.0 From an advisory covering 7 CVEs |
before 4.2.1-11.28.1 | 4.2.1-11.28.1 |
qemuSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 7 CVEs |
before 3.1.1.1-57.2 | 3.1.1.1-57.2 |
qemuSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 7 CVEs |
before 3.1.1.1-57.2 | 3.1.1.1-57.2 |
qemuSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 7 CVEs |
before 5.2.0-103.2 | 5.2.0-103.2 |
qemuSUSE:Linux Enterprise Module for Server Applications 15 SP3 From an advisory covering 7 CVEs |
before 5.2.0-103.2 | 5.2.0-103.2 |
qemuSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 7 CVEs |
before 2.6.2-41.73.1 | 2.6.2-41.73.1 |
qemuSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 9 CVEs |
before 2.11.2-70.59.1 | 2.11.2-70.59.1 |
qemuSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 9 CVEs |
before 2.11.2-70.59.1 | 2.11.2-70.59.1 |
qemuSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 9 CVEs |
before 2.11.2-70.59.1 | 2.11.2-70.59.1 |
qemuSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 9 CVEs |
before 2.11.2-70.59.1 | 2.11.2-70.59.1 |
qemuSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 9 CVEs |
before 3.1.1.1-80.40.1 | 3.1.1.1-80.40.1 |
qemuSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 9 CVEs |
before 3.1.1.1-80.40.1 | 3.1.1.1-80.40.1 |
qemuSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 9 CVEs |
before 3.1.1.1-80.40.1 | 3.1.1.1-80.40.1 |
qemuSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 9 CVEs |
before 3.1.1.1-80.40.1 | 3.1.1.1-80.40.1 |
qemuSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 9 CVEs |
before 3.1.1.1-80.40.1 | 3.1.1.1-80.40.1 |
qemuSUSE:Enterprise Storage 6 From an advisory covering 9 CVEs |
before 3.1.1.1-80.40.1 | 3.1.1.1-80.40.1 |
qemuSUSE:OpenStack Cloud 9 From an advisory covering 9 CVEs |
before 2.11.2-5.40.2 | 2.11.2-5.40.2 |
qemuSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 9 CVEs |
before 2.11.2-5.40.2 | 2.11.2-5.40.2 |
qemuSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 9 CVEs |
before 2.11.2-5.40.2 | 2.11.2-5.40.2 |
qemuSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 9 CVEs |
before 2.11.2-5.40.2 | 2.11.2-5.40.2 |
qemuopenSUSE:Leap 15.2 From an advisory covering 15 CVEs |
before 4.2.1-lp152.9.20.1 | 4.2.1-lp152.9.20.1 |
qemu-linux-useropenSUSE:Leap 15.2 From an advisory covering 15 CVEs |
before 4.2.1-lp152.9.20.1 | 4.2.1-lp152.9.20.1 |
qemu-testsuiteopenSUSE:Leap 15.2 From an advisory covering 15 CVEs |
before 4.2.1-lp152.9.20.1 | 4.2.1-lp152.9.20.1 |
qemuopenSUSE:Leap 15.3 From an advisory covering 7 CVEs |
before 4.2.1-11.28.1 | 4.2.1-11.28.1 |
qemuopenSUSE:Leap 15.3 From an advisory covering 7 CVEs |
before 5.2.0-103.2 | 5.2.0-103.2 |
qemuopenSUSE:Leap 15.3 From an advisory covering 9 CVEs |
before 3.1.1.1-80.40.1 | 3.1.1.1-80.40.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-35506 is a medium vulnerability (CVSS 6.7) in Qemu, published May 28, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in qemu 6.0.0-r2.
References
openwall.com/lists/oss-security/2021/04/16/3
bugzilla.redhat.com/show_bug.cgi?id=1909996
security.netapp.com/advisory/ntap-20210713-0006
security.gentoo.org/glsa/202208-27
nvd.nist.gov/vuln/detail/CVE-2020-35506
github.com/advisories/GHSA-qfjc-pj3q-qmpf
Show 49 moreShow less
security.alpinelinux.org/vuln/CVE-2020-35506
docs.bell-sw.com/security/cves/CVE-2020-35506
security-tracker.debian.org/tracker/CVE-2020-35506
suse.com/support/update/announcement/2021/suse-su-20212789-1
bugzilla.suse.com/1180432
lists.opensuse.org/archives/list/[email protected]/thread/7XTOHNMISPT4N5NUXQJPKV5LQNNGSMFI