Skip to content
Fencer Intel
medium 5.5

CVE-2020-10702 json

A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in…

published 6y ago modified 4mo ago also EUVD-2020-3133

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits
0
none known

Summary

A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU.

Patch / fix

  • qemu qemu 5.0.0
  • qemu Debian 14, Debian 13, Debian 12 1:4.2-5

debian advisories DEBIAN-CVE-2020-10702

  • qemu Ubuntu 20.04 LTS 1:4.2-3ubuntu5

ubuntu advisories UBUNTU-CVE-2020-10702

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • SLOF advanced virtualization 8.2 20191022-3.git899d9883.module+el8.2.0+5449+efc036dd
  • hivex advanced virtualization 8.2 1.3.18-20.module+el8.2.0+5588+63a201c3
  • netcf advanced virtualization 8.2 0.2.8-12.module+el8.2.0+4793+b09dd2fb
  • swtpm advanced virtualization 8.2 0.2.0-2.20200127gitff5a83b.module+el8.2.0+5579+d71178e0
  • libnbd advanced virtualization 8.2 1.2.2-1.module+el8.2.0+5644+32ac38d4
  • nbdkit advanced virtualization 8.2 1.16.2-4.module+el8.2.1+6710+effcb1df
  • libtpms advanced virtualization 8.2 0.7.0-1.20191018gitdc116933b7.module+el8.2.0+4793+b09dd2fb
  • libvirt advanced virtualization 8.2 6.0.0-25.module+el8.2.1+7154+47ffd890

red hat advisories RHBA-2020:3172

  • qemu openSUSE Tumbleweed 6.1.0-32.1

opensuse advisories openSUSE-SU-2024:11287-1

Is CVE-2020-10702 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-10702 updated cvss 5.5

qemu: weak signature generation in Pointer Authentication support for ARM

  • Red Hat Enterprise Linux 8 Advanced Virtualization qemu-img, qemu-kvm, qemu-kiwi, qemu-kvm-core, qemu-kvm-tests, qemu-kvm-common, +9 more
    affected: no fix available
  • Red Hat OpenStack Platform 14 (Rocky) qemu-img-rhev, qemu-kvm-rhev, qemu-kvm-tools-rhev, qemu-kvm-common-rhev
    affected: no fix planned “Out of support scope”
  • Red Hat Advanced Virtualization CodeReady Builder for RHEL 8.2.1 libnbd 1.2.2-1.module+el8.2.0+5644+32ac38d4, netcf 0.2.8-12.module+el8.2.0+4793+b09dd2fb, hivex 1.3.18-20.module+el8.2.0+5588+63a201c3, nbdfuse 1.2.2-1.module+el8.2.0+5644+32ac38d4, libvirt 6.0.0-25.module+el8.2.1+7154+47ffd890, seabios 1.13.0-2.module+el8.2.1+7284+aa32a2c4, +45 more Red Hat Advanced Virtualization for RHEL 8.2.1 libnbd 1.2.2-1.module+el8.2.0+5644+32ac38d4, netcf 0.2.8-12.module+el8.2.0+4793+b09dd2fb, hivex 1.3.18-20.module+el8.2.0+5588+63a201c3, nbdfuse 1.2.2-1.module+el8.2.0+5644+32ac38d4, nbdkit 1.16.2-4.module+el8.2.1+6710+effcb1df, libvirt 6.0.0-25.module+el8.2.1+7154+47ffd890, +96 more
    fixed: vendor fix RHBA-2020:3172
  • Red Hat Enterprise Linux 5 kvm, xen Red Hat Enterprise Linux 6 qemu-img, qemu-kvm, qemu-kvm-tools, qemu-guest-agent, qemu-guest-agent-win32 Red Hat Enterprise Linux 7 qemu-img, qemu-kvm, libcacard, qemu-img-ma, qemu-kvm-ma, qemu-kvm-rhev, +6 more Red Hat Enterprise Linux 8 qemu-img, qemu-kvm, qemu-kvm-core, qemu-kvm-tests, qemu-kvm-common, qemu-guest-agent, +8 more Red Hat OpenStack Platform 10 (Newton) qemu-img-rhev, qemu-kvm-rhev, qemu-kvm-tools-rhev, qemu-kvm-common-rhev Red Hat OpenStack Platform 13 (Queens) qemu-img-rhev, qemu-kvm-rhev, qemu-kvm-tools-rhev, qemu-kvm-common-rhev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • The QEMU Project qemu

Classification

Weakness
  • CWE-325 Missing Cryptographic Step

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.