CVE-2019-12067

Published: Jun 2, 2021Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Exploitability: 2.0 / Impact: 4.0

Source: NVD

Description

The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header 'ad->cur_cmd' is null.

Affected (9)

Products: Qemu: Qemu · Debian: Debian Linux · Fedoraproject: Fedora · +1 more

Show all products

Qemu: Qemu · Debian: Debian Linux · Fedoraproject: Fedora · Redhat: Enterprise Linux, Openstack Platform

1 product

1 product

1 product

2 products

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Qemu Qemu	All versions

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 9.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 30

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 8.0
Redhat Openstack Platform	Version 10.0
Redhat Openstack Platform	Version 14.0

Related CWEs

CWE-476

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (10)

https://bugzilla.suse.com/show_bug.cgi?id=1145642

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01358.html

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01487.html

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

https://security-tracker.debian.org/tracker/CVE-2019-12067

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210727-0001/

Source: cve@mitre.org

Third Party Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1145642