USN-4467-3
qemu regression
USN-4467-1 fixed vulnerabilities in QEMU. The fix for CVE-2020-13754 introduced a regression in certain environments. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Ren Ding, Hanqing Zhao, Alexander Bulekov, and Anatoly Trosinenko discovered that the QEMU incorrectly handled certain msi-x mmio operations. An attacker inside a guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-13754)
What each source reports
OSVNo score
qemu regression
USN-4467-1 fixed vulnerabilities in QEMU. The fix for CVE-2020-13754 introduced a regression in certain environments. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Ren Ding, Hanqing Zhao, Alexander Bulekov, and Anatoly Trosinenko discovered that the QEMU incorrectly handled certain msi-x mmio operations. An attacker inside a guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-13754)
- Record
USN-4467-3- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuUbuntu:16.04:LTS | before 1:2.5+dfsg-5ubuntu10.51, plus listed versions 1:2.3+dfsg-5ubuntu91:2.3+dfsg-5ubuntu101:2.4+dfsg-4ubuntu11:2.4+dfsg-4ubuntu21:2.4+dfsg-4ubuntu3 Show 45 moreShow less1:2.4+dfsg-5ubuntu31:2.5+dfsg-1ubuntu21:2.5+dfsg-1ubuntu31:2.5+dfsg-1ubuntu41:2.5+dfsg-1ubuntu51:2.5+dfsg-5ubuntu11:2.5+dfsg-5ubuntu21:2.5+dfsg-5ubuntu41:2.5+dfsg-5ubuntu61:2.5+dfsg-5ubuntu71:2.5+dfsg-5ubuntu101:2.5+dfsg-5ubuntu10.11:2.5+dfsg-5ubuntu10.21:2.5+dfsg-5ubuntu10.31:2.5+dfsg-5ubuntu10.41:2.5+dfsg-5ubuntu10.51:2.5+dfsg-5ubuntu10.61:2.5+dfsg-5ubuntu10.71:2.5+dfsg-5ubuntu10.81:2.5+dfsg-5ubuntu10.91:2.5+dfsg-5ubuntu10.101:2.5+dfsg-5ubuntu10.111:2.5+dfsg-5ubuntu10.131:2.5+dfsg-5ubuntu10.141:2.5+dfsg-5ubuntu10.151:2.5+dfsg-5ubuntu10.161:2.5+dfsg-5ubuntu10.201:2.5+dfsg-5ubuntu10.211:2.5+dfsg-5ubuntu10.221:2.5+dfsg-5ubuntu10.241:2.5+dfsg-5ubuntu10.251:2.5+dfsg-5ubuntu10.261:2.5+dfsg-5ubuntu10.281:2.5+dfsg-5ubuntu10.291:2.5+dfsg-5ubuntu10.301:2.5+dfsg-5ubuntu10.311:2.5+dfsg-5ubuntu10.321:2.5+dfsg-5ubuntu10.331:2.5+dfsg-5ubuntu10.341:2.5+dfsg-5ubuntu10.351:2.5+dfsg-5ubuntu10.361:2.5+dfsg-5ubuntu10.371:2.5+dfsg-5ubuntu10.381:2.5+dfsg-5ubuntu10.391:2.5+dfsg-5ubuntu10.40 | 1:2.5+dfsg-5ubuntu10.51 |
qemuUbuntu:18.04:LTS | before 1:2.11+dfsg-1ubuntu7.36, plus listed versions 1:2.10+dfsg-0ubuntu31:2.10+dfsg-0ubuntu41:2.10+dfsg-0ubuntu51:2.11+dfsg-1ubuntu11:2.11+dfsg-1ubuntu2 Show 35 moreShow less1:2.11+dfsg-1ubuntu41:2.11+dfsg-1ubuntu51:2.11+dfsg-1ubuntu61:2.11+dfsg-1ubuntu71:2.11+dfsg-1ubuntu7.11:2.11+dfsg-1ubuntu7.21:2.11+dfsg-1ubuntu7.31:2.11+dfsg-1ubuntu7.41:2.11+dfsg-1ubuntu7.51:2.11+dfsg-1ubuntu7.61:2.11+dfsg-1ubuntu7.71:2.11+dfsg-1ubuntu7.81:2.11+dfsg-1ubuntu7.91:2.11+dfsg-1ubuntu7.101:2.11+dfsg-1ubuntu7.121:2.11+dfsg-1ubuntu7.131:2.11+dfsg-1ubuntu7.141:2.11+dfsg-1ubuntu7.151:2.11+dfsg-1ubuntu7.171:2.11+dfsg-1ubuntu7.181:2.11+dfsg-1ubuntu7.191:2.11+dfsg-1ubuntu7.201:2.11+dfsg-1ubuntu7.211:2.11+dfsg-1ubuntu7.221:2.11+dfsg-1ubuntu7.231:2.11+dfsg-1ubuntu7.251:2.11+dfsg-1ubuntu7.261:2.11+dfsg-1ubuntu7.271:2.11+dfsg-1ubuntu7.281:2.11+dfsg-1ubuntu7.291:2.11+dfsg-1ubuntu7.311:2.11+dfsg-1ubuntu7.321:2.11+dfsg-1ubuntu7.331:2.11+dfsg-1ubuntu7.341:2.11+dfsg-1ubuntu7.35 | 1:2.11+dfsg-1ubuntu7.36 |
qemuUbuntu:20.04:LTS | before 1:4.2-3ubuntu6.14, plus listed versions 1:4.0+dfsg-0ubuntu91:4.0+dfsg-0ubuntu101:4.2-1ubuntu11:4.2-1ubuntu21:4.2-3ubuntu1 Show 17 moreShow less1:4.2-3ubuntu21:4.2-3ubuntu31:4.2-3ubuntu41:4.2-3ubuntu51:4.2-3ubuntu61:4.2-3ubuntu6.11:4.2-3ubuntu6.21:4.2-3ubuntu6.31:4.2-3ubuntu6.41:4.2-3ubuntu6.51:4.2-3ubuntu6.61:4.2-3ubuntu6.71:4.2-3ubuntu6.81:4.2-3ubuntu6.91:4.2-3ubuntu6.101:4.2-3ubuntu6.111:4.2-3ubuntu6.12 | 1:4.2-3ubuntu6.14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-4467-3 is a vulnerability with no CVSS score yet in qemu, published February 22, 2021. No source lists public exploit code. Fixed in qemu 1:2.5+dfsg-5ubuntu10.51.
References
Left out here: 9 versions. The JSON record has them.