{"id":"CVE-2020-24352","aliases":["ALPINE-CVE-2020-24352","BELL-CVE-2020-24352","DEBIAN-CVE-2020-24352","EUVD-2020-17086","GHSA-mm2v-p2cv-qgm2","SUSE-SU-2020:2877-1","UBUNTU-CVE-2020-24352","openSUSE-SU-2020:1664-1"],"status":"published","title":"An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the...","description":"An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00415,"percentile":0.36125,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-125","CWE-787"],"published":"2020-10-07T12:43:34Z","modified":"2026-11-03T06:32:36Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"qemu","fixed_in":["5.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"qemu","fixed_in":["5.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"qemu","fixed_in":["5.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"qemu","fixed_in":["5.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"qemu","fixed_in":["5.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"qemu","fixed_in":["5.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"qemu","fixed_in":["5.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"qemu","fixed_in":["5.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"qemu","fixed_in":["5.2.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:5.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:5.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:5.2+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:5.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-11.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-11.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.0+dfsg-0ubuntu9","1:4.0+dfsg-0ubuntu10","1:4.2-1ubuntu1","1:4.2-1ubuntu2","1:4.2-3ubuntu1","1:4.2-3ubuntu2","1:4.2-3ubuntu3","1:4.2-3ubuntu4","1:4.2-3ubuntu5","1:4.2-3ubuntu6","1:4.2-3ubuntu6.1","1:4.2-3ubuntu6.2","1:4.2-3ubuntu6.3","1:4.2-3ubuntu6.4","1:4.2-3ubuntu6.5","1:4.2-3ubuntu6.6","1:4.2-3ubuntu6.7","1:4.2-3ubuntu6.8","1:4.2-3ubuntu6.9","1:4.2-3ubuntu6.10","1:4.2-3ubuntu6.11","1:4.2-3ubuntu6.12","1:4.2-3ubuntu6.14","1:4.2-3ubuntu6.15","1:4.2-3ubuntu6.16","1:4.2-3ubuntu6.17","1:4.2-3ubuntu6.18","1:4.2-3ubuntu6.19","1:4.2-3ubuntu6.21","1:4.2-3ubuntu6.23","1:4.2-3ubuntu6.24","1:4.2-3ubuntu6.25","1:4.2-3ubuntu6.26","1:4.2-3ubuntu6.27","1:4.2-3ubuntu6.28","1:4.2-3ubuntu6.29","1:4.2-3ubuntu6.30","1:4.2-3ubuntu6.30+esm1","1:4.2-3ubuntu6.30+esm2","1:4.2-3ubuntu6.30+esm3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.2.1+ds-1ubuntu5","1:10.0.2+ds-1ubuntu1","1:10.0.2+ds-1ubuntu2","1:10.1.0+ds-1ubuntu1","1:10.1.0+ds-5ubuntu1","1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu2.1","1:10.1.0+ds-5ubuntu2.2","1:10.1.0+ds-5ubuntu2.4","1:10.1.0+ds-5ubuntu2.5","1:10.1.0+ds-5ubuntu2.6","1:10.1.0+ds-5ubuntu2.7"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-lp152.9.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-lp152.9.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"qemu-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-lp152.9.6.1"}]}],"bundled":4}],"products":[{"vendor":"qemu","product":"qemu"}],"references":[{"url":"https://git.qemu.org/?p=qemu.git","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847584","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20201123-0003/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24352"},{"url":"https://git.qemu.org/?p=qemu.git;a=commitdiff;h=ca1f9cbfdce4d63b10d57de80fef89a89d92a540;hp=2ddafce7f797082ad216657c830afd4546f16e37"},{"url":"https://github.com/advisories/GHSA-mm2v-p2cv-qgm2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-24352","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-24352","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-24352","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202877-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1174386","tags":["report"]},{"url":"https://bugzilla.suse.com/1174641","tags":["report"]},{"url":"https://bugzilla.suse.com/1174863","tags":["report"]},{"url":"https://bugzilla.suse.com/1175370","tags":["report"]},{"url":"https://bugzilla.suse.com/1175441","tags":["report"]},{"url":"https://bugzilla.suse.com/1176494","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24352","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-24352","tags":["report"]},{"url":"https://lists.gnu.org/archive/html/qemu-devel/2020-08/msg05483.html","tags":["report"]},{"url":"https://lists.gnu.org/archive/html/qemu-devel/2020-08/msg05720.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-24352","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QVFXHYA5K5PLF3ZBKNJIJ5BFDWNHLJZM/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-24352","description":"An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2020-10-16T05:05:13Z","modified":"2024-08-04T15:12:08.689Z","updated_at":"2026-11-02T14:35:54.468882Z"}],"euvd":[{"id":"EUVD-2020-17086","description":"An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2020-10-16T05:05:13Z","modified":"2024-08-04T15:12:08Z","updated_at":"2026-11-03T03:07:20.249898Z"}],"ghsa":[{"id":"GHSA-mm2v-p2cv-qgm2","title":"An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the...","description":"An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2022-05-24T17:31:03Z","modified":"2023-01-29T05:04:54Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:45:39.783328Z"}],"nvd":[{"id":"CVE-2020-24352","description":"An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2020-10-16T06:15:12.277Z","modified":"2026-06-17T03:05:25.063Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T14:06:19.351389Z"}],"osv":[{"id":"ALPINE-CVE-2020-24352","description":"An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2020-10-16T06:15:12.277Z","modified":"2026-11-03T06:32:36.75931661Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:17:20.312441Z"},{"id":"BELL-CVE-2020-24352","title":"CVE-2020-24352 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:49.515682Z","modified":"2026-01-26T09:50:11.575891Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-24352","description":"An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2020-10-16T06:15:12.277Z","modified":"2026-10-24T10:51:22.264071498Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"DEBIAN-CVE-2020-24352","description":"An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2020-10-16T06:15:12.277Z","modified":"2026-10-26T12:02:30.047849575Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"UBUNTU-CVE-2020-24352","description":"An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2020-10-16T06:15:00Z","modified":"2026-08-20T22:52:19.951925691Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"openSUSE-SU-2020:1664-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2020-14364: Fixed an OOB access while processing USB packets (bsc#1175441,bsc#1176494).\n- CVE-2020-16092: Fixed a denial of service in packet processing of various emulated NICs (bsc#1174641).\n- CVE-2020-15863: Fixed a buffer overflow in the XGMAC device (bsc#1174386).\n- CVE-2020-24352: Fixed an out-of-bounds read/write in ati-vga device emulation in ati_2d_blt (bsc#1175370).\n- Allow to IPL secure guests with -no-reboot (bsc#1174863)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-10-12T22:21:35Z","modified":"2026-02-04T03:08:14.858038Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"SUSE-SU-2020:2877-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2020-14364: Fixed an OOB access while processing USB packets (bsc#1175441,bsc#1176494).\n- CVE-2020-16092: Fixed a denial of service in packet processing of various emulated NICs (bsc#1174641).\n- CVE-2020-15863: Fixed a buffer overflow in the XGMAC device (bsc#1174386).\n- CVE-2020-24352: Fixed an out-of-bounds read/write in ati-vga device emulation in ati_2d_blt (bsc#1175370).\n- Allow to IPL secure guests with -no-reboot (bsc#1174863)\n","status":"published","published":"2020-10-07T12:43:34Z","modified":"2026-02-04T03:45:21.065555Z","updated_at":"2026-11-02T15:53:48.11786Z"}]}}