What’s Vulnerable › Vulnerabilities

CVE-2019-12068

• Severity: low (CVSS 3.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-09-24 · updated 2026-06-17
• Weakness: CWE-835

Description

In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 19.04, 19.10
• openSUSE Leap: 15.0, 15.1
• QEMU: 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8+deb10u2, 1:3.1+dfsg-8~deb10u1

References

• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00034.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00038.html
• https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=de594e47659029316bbf9391efb79da0a1a08e08
• https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html
• https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html
• https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01518.html
• https://security-tracker.debian.org/tracker/CVE-2019-12068
• https://usn.ubuntu.com/4191-1/
• https://usn.ubuntu.com/4191-2/
• https://www.debian.org/security/2020/dsa-4665
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00034.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00038.html

Get alerted when CVE-2019-12068 or the next vulnerability affects your stack