CVE-2020-24352

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-16 · updated 2026-06-17
Weakness: CWE-125

Description

An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.

Affected products

QEMU: through 4.2.1; 5.0.0-rc0, 5.0.0-rc1

References

https://bugzilla.redhat.com/show_bug.cgi?id=1847584
https://git.qemu.org/?p=qemu.git
https://security.netapp.com/advisory/ntap-20201123-0003/
https://bugzilla.redhat.com/show_bug.cgi?id=1847584
https://git.qemu.org/?p=qemu.git
https://security.netapp.com/advisory/ntap-20201123-0003/

Get alerted when CVE-2020-24352 or the next vulnerability affects your stack