CVE-2020-35505

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-28 · updated 2026-06-17
Weakness: CWE-476

Description

A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Affected products

Debian Linux: 10.0
QEMU: before 6.0.0; 6.0.0-rc1, 6.0.0-rc2 — fixed in 6.0.0

How to fix

Upgrade to a fixed version: QEMU 6.0.0. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2021/04/16/3
https://bugzilla.redhat.com/show_bug.cgi?id=1909769
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
https://security.gentoo.org/glsa/202208-27
https://security.netapp.com/advisory/ntap-20210713-0006/
https://www.openwall.com/lists/oss-security/2021/04/16/3
http://www.openwall.com/lists/oss-security/2021/04/16/3
https://bugzilla.redhat.com/show_bug.cgi?id=1909769
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
https://security.gentoo.org/glsa/202208-27
https://security.netapp.com/advisory/ntap-20210713-0006/
https://www.openwall.com/lists/oss-security/2021/04/16/3

Get alerted when CVE-2020-35505 or the next vulnerability affects your stack