{"id":"CVE-2020-13791","aliases":["ALPINE-CVE-2020-13791","BELL-CVE-2020-13791","DEBIAN-CVE-2020-13791","EUVD-2020-6007","GHSA-9j9x-v7hw-3v8f","OESA-2023-1654","OESA-2023-1655","UBUNTU-CVE-2020-13791"],"status":"published","title":"hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing...","description":"hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00398,"percentile":0.34529,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2020-06-04T15:24:53Z","modified":"2026-11-03T06:32:23Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"qemu","fixed_in":["5.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"qemu","fixed_in":["5.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"qemu","fixed_in":["5.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"qemu","fixed_in":["5.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"qemu","fixed_in":["5.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"qemu","fixed_in":["5.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"qemu","fixed_in":["5.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"qemu","fixed_in":["5.0.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"qemu","fixed_in":["5.0.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:5.0-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:5.0-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:5.0-6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.0-6"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-76.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-80.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.0+dfsg-0ubuntu9","1:4.0+dfsg-0ubuntu10","1:4.2-1ubuntu1","1:4.2-1ubuntu2","1:4.2-3ubuntu1","1:4.2-3ubuntu2","1:4.2-3ubuntu3","1:4.2-3ubuntu4","1:4.2-3ubuntu5","1:4.2-3ubuntu6","1:4.2-3ubuntu6.1","1:4.2-3ubuntu6.2","1:4.2-3ubuntu6.3","1:4.2-3ubuntu6.4","1:4.2-3ubuntu6.5","1:4.2-3ubuntu6.6","1:4.2-3ubuntu6.7","1:4.2-3ubuntu6.8","1:4.2-3ubuntu6.9","1:4.2-3ubuntu6.10","1:4.2-3ubuntu6.11","1:4.2-3ubuntu6.12","1:4.2-3ubuntu6.14","1:4.2-3ubuntu6.15","1:4.2-3ubuntu6.16","1:4.2-3ubuntu6.17","1:4.2-3ubuntu6.18","1:4.2-3ubuntu6.19","1:4.2-3ubuntu6.21","1:4.2-3ubuntu6.23","1:4.2-3ubuntu6.24","1:4.2-3ubuntu6.25","1:4.2-3ubuntu6.26","1:4.2-3ubuntu6.27","1:4.2-3ubuntu6.28","1:4.2-3ubuntu6.29","1:4.2-3ubuntu6.30","1:4.2-3ubuntu6.30+esm1","1:4.2-3ubuntu6.30+esm2","1:4.2-3ubuntu6.30+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10","1:6.2+dfsg-2ubuntu6.11","1:6.2+dfsg-2ubuntu6.12","1:6.2+dfsg-2ubuntu6.13","1:6.2+dfsg-2ubuntu6.14","1:6.2+dfsg-2ubuntu6.15","1:6.2+dfsg-2ubuntu6.16","1:6.2+dfsg-2ubuntu6.17","1:6.2+dfsg-2ubuntu6.18","1:6.2+dfsg-2ubuntu6.19","1:6.2+dfsg-2ubuntu6.21","1:6.2+dfsg-2ubuntu6.22","1:6.2+dfsg-2ubuntu6.23","1:6.2+dfsg-2ubuntu6.24","1:6.2+dfsg-2ubuntu6.25","1:6.2+dfsg-2ubuntu6.26","1:6.2+dfsg-2ubuntu6.27","1:6.2+dfsg-2ubuntu6.28","1:6.2+dfsg-2ubuntu6.29","1:6.2+dfsg-2ubuntu6.30","1:6.2+dfsg-2ubuntu6.31"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9","1:8.2.2+ds-0ubuntu1.10","1:8.2.2+ds-0ubuntu1.11","1:8.2.2+ds-0ubuntu1.12","1:8.2.2+ds-0ubuntu1.13","1:8.2.2+ds-0ubuntu1.14","1:8.2.2+ds-0ubuntu1.15","1:8.2.2+ds-0ubuntu1.16","1:8.2.2+ds-0ubuntu1.17","1:8.2.2+ds-0ubuntu1.18"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.2.1+ds-1ubuntu5","1:10.0.2+ds-1ubuntu1","1:10.0.2+ds-1ubuntu2","1:10.1.0+ds-1ubuntu1","1:10.1.0+ds-5ubuntu1","1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu2.1","1:10.1.0+ds-5ubuntu2.2","1:10.1.0+ds-5ubuntu2.4","1:10.1.0+ds-5ubuntu2.5","1:10.1.0+ds-5ubuntu2.6","1:10.1.0+ds-5ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu3","1:10.2.1+ds-1ubuntu6","1:11.0.3+ds-2ubuntu1","1:11.0.3+ds-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qemu-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu4","1:10.2.1+ds-1ubuntu7","1:10.2.1+ds-1ubuntu8","1:11.0.3+ds-2ubuntu2","1:11.0.3+ds-2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu3","1:10.1.0+ds-5ubuntu4","1:10.1.0+ds-5ubuntu5","1:10.2.1+ds-1ubuntu1","1:10.2.1+ds-1ubuntu2","1:10.2.1+ds-1ubuntu3","1:10.2.1+ds-1ubuntu3.1","1:10.2.1+ds-1ubuntu3.2","1:10.2.1+ds-1ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qemu-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu2","1:10.2.1+ds-1ubuntu4","1:10.2.1+ds-1ubuntu4.2","1:10.2.1+ds-1ubuntu4.3","1:10.2.1+ds-1ubuntu4.4"]}],"products":[{"vendor":"qemu","product":"qemu"}],"references":[{"url":"https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00706.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/06/04/1","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"https://security.netapp.com/advisory/ntap-20200717-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202011-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13791","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9j9x-v7hw-3v8f"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-13791","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-13791","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-13791","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1654","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24165","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1655","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-13791","tags":["report"]},{"url":"https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg00831.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13791","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-13791","description":"hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.","status":"published","published":"2020-06-04T15:24:53Z","modified":"2024-08-04T12:25:16.568Z","updated_at":"2026-11-02T14:35:53.868619Z"}],"euvd":[{"id":"EUVD-2020-6007","description":"hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.","status":"published","published":"2020-06-04T15:24:53Z","modified":"2024-08-04T12:25:16Z","updated_at":"2026-11-03T03:07:36.6695Z"}],"ghsa":[{"id":"GHSA-9j9x-v7hw-3v8f","title":"hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing...","description":"hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.","status":"published","published":"2022-05-24T17:19:17Z","modified":"2023-01-29T05:02:50Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:45:10.945052Z"}],"nvd":[{"id":"CVE-2020-13791","description":"hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.","status":"published","published":"2020-06-04T16:15:12.797Z","modified":"2026-06-17T02:53:39.707Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:05.962132Z"}],"osv":[{"id":"ALPINE-CVE-2020-13791","description":"hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.","status":"published","published":"2020-06-04T16:15:12.797Z","modified":"2026-11-03T06:32:23.647267615Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"BELL-CVE-2020-13791","title":"CVE-2020-13791 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:16.843667Z","modified":"2026-01-26T09:49:10.383459Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2020-13791","description":"hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.","status":"published","published":"2020-06-04T16:15:12.797Z","modified":"2026-10-24T10:30:44.829257497Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-13791","description":"hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.","status":"published","published":"2020-06-04T16:15:12.797Z","modified":"2026-10-26T12:00:35.16853809Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"OESA-2023-1654","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\n\r\n\r\nSecurity Fix(es):\r\n\r\nhw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.(CVE-2020-13791)\r\n\r\nAn issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS).(CVE-2020-24165)","status":"published","published":"2023-09-15T11:06:06Z","modified":"2026-08-18T01:17:02.927005551Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1655","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\n\r\n\r\nSecurity Fix(es):\r\n\r\nhw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.(CVE-2020-13791)\r\n\r\nAn issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS).(CVE-2020-24165)","status":"published","published":"2023-09-15T11:06:06Z","modified":"2026-08-18T01:17:03.451268338Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"UBUNTU-CVE-2020-13791","description":"hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.","status":"published","published":"2020-06-04T16:15:00Z","modified":"2026-10-22T23:15:41.237790841Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:22.804634Z"}]}}