CVSS 3.1
6.0 mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:LCVE-2020-1711
Medium (6.0). EPSS 4.0% chance of exploitation in the next 30 days.
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.
Severity
- EPSS
- 4.0% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-787, CWE-122
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- opensuse:leap
- qemu:qemu
- redhat:enterprise_linux
- redhat:openstack