CVE-2020-12829
Publication date 26 May 2020
Last updated 18 August 2025
Ubuntu priority
Description
In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| qemu | 25.10 questing |
Not affected
|
| 25.04 plucky |
Not affected
|
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Fixed 1:4.2-3ubuntu6.4
|
|
| 18.04 LTS bionic |
Fixed 1:2.11+dfsg-1ubuntu7.31
|
|
| 16.04 LTS xenial |
Fixed 1:2.5+dfsg-5ubuntu10.45
|
|
| 14.04 LTS trusty |
Vulnerable
|
|
| qemu-kvm | 25.10 questing | Not in release |
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release |
Patch details
| Package | Patch details |
|---|---|
| qemu |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
3.8 · Low
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Changed |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | Low |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L |
References
Related Ubuntu Security Notices (USN)
- USN-4467-1
- QEMU vulnerabilities
- 19 August 2020