CVE-2020-25723

Severity: low (CVSS 3.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-02 · updated 2026-06-17
Weakness: CWE-617

Description

A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.

Affected products

Debian Linux: 10.0
QEMU: through 5.1.1

References

http://www.openwall.com/lists/oss-security/2020/12/22/1
https://bugzilla.redhat.com/show_bug.cgi?id=1898579
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
https://security.netapp.com/advisory/ntap-20201218-0004/
http://www.openwall.com/lists/oss-security/2020/12/22/1
https://bugzilla.redhat.com/show_bug.cgi?id=1898579
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
https://security.netapp.com/advisory/ntap-20201218-0004/

Get alerted when CVE-2020-25723 or the next vulnerability affects your stack