CVE-2020-8608 json
In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.
published 6y ago modified 4mo ago also EUVD-2020-29456
- cvss
- 5.6
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.5%
- EPSS 2.5% chance of exploitation in 30 days, percentile 84%
- public exploits
- 0
- none known
Summary
In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.
Patch / fix
- qemu Debian 14, Debian 13, Debian 12 1:4.1-2
- slirp Debian 14, Debian 13, Debian 12 1:1.0.17-11
- libslirp Debian 14, Debian 13, Debian 12 4.2.0-1
- slirp4netns Debian 14, Debian 13, Debian 12 1.0.1-1
debian advisories DEBIAN-CVE-2020-8608
- qemu Ubuntu 16.04 LTS 1:2.5+dfsg-5ubuntu10.43
- qemu Ubuntu 18.04 LTS 1:2.11+dfsg-1ubuntu7.23
- slirp Ubuntu 16.04 LTS 1:1.0.17-8ubuntu16.04.1
- slirp Ubuntu 18.04 LTS 1:1.0.17-8ubuntu18.04.1
- libslirp Ubuntu 20.04 LTS 4.1.0-2ubuntu1
- qemu Ubuntu Pro 14.04 LTS 2.0.0+dfsg-2ubuntu1.47+esm4
- slirp Ubuntu Pro 14.04 LTS 1:1.0.17-7+deb8u2build0.14.04.1+esm1
ubuntu advisories UBUNTU-CVE-2020-8608
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- cri-o openshift 4.3 1.16.3-20.dev.rhaos4.3.git11c04e3.el7
- cri-o openshift 4.3 1.16.3-22.dev.rhaos4.3.git11c04e3.el8
- dracut openshift 4.3 049-64.git20200123.el8
- jenkins openshift 4.3 2.204.1.1581950993-1.el7
- toolbox openshift 4.3 0.0.6-1.rhaos4.3.el8
- cri-tools openshift 4.3 1.17.0-1.el8
- openshift openshift 4.3 4.3.3-202002140552.git.0.e38059c.el7
- openshift openshift 4.3 4.3.3-202002140552.git.0.e38059c.el8
red hat advisories RHSA-2020:3040RHBA-2020:0527RHSA-2020:2844RHSA-2020:2773RHSA-2020:2774RHSA-2020:2730
- qemu SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 2.11.2-5.32.1
- qemu SLE Module for Server Applications 15 SP3, SLE Module for Basesystem 15 SP3 5.2.0-17.1
- qemu SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +7 more 3.1.1.1-9.27.2
- qemu SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 2.11.2-9.46.1
- qemu SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +3 more 2.9.1-6.50.1
- qemu SLE Module for Server Applications 15 SP2, SLE Module for Basesystem 15 SP2, SLE Micro 5.0 4.2.1-11.19.2
- qemu SLES for SAP 12 SP5, SLES 12 SP5 3.1.1.1-51.1
- qemu SLES 12 SP2-BCL 2.6.2-41.65.1
suse advisories SUSE-SU-2021:1947-1SUSE-SU-2021:1942-1SUSE-SU-2021:1918-1SUSE-SU-2021:1895-1SUSE-SU-2021:1894-1SUSE-SU-2021:1893-1
- qemu openSUSE Tumbleweed 6.1.0-32.1
- qemu openSUSE Leap 15.2 4.2.1-lp152.9.16.2
- qemu-testsuite openSUSE Leap 15.2 4.2.1-lp152.9.16.7
- qemu-linux-user openSUSE Leap 15.2 4.2.1-lp152.9.16.1
- qemu openSUSE Leap 15.3 5.2.0-17.1
- qemu openSUSE Leap 15.1 3.1.1.1-lp151.7.12.1
- qemu-linux-user openSUSE Leap 15.1 3.1.1.1-lp151.7.12.1
opensuse advisories openSUSE-SU-2024:11287-1openSUSE-SU-2021:1043-1openSUSE-SU-2021:1942-1openSUSE-SU-2020:0468-1
- netcf AlmaLinux 8 0.2.8-12.module_el8.5.0+2608+72063365
- netcf AlmaLinux 8 0.2.8-12.module_el8.6.0+2880+7d9e3703
- netcf AlmaLinux 8 0.2.8-12.module_el8.3.0+2048+e7a0a3ea
- sgabios AlmaLinux 8 1:0.20170427git-3.module_el8.5.0+2608+72063365
- sgabios AlmaLinux 8 1:0.20170427git-3.module_el8.3.0+2048+e7a0a3ea
- libiscsi AlmaLinux 8 1.18.0-8.module_el8.6.0+2880+7d9e3703
- libiscsi AlmaLinux 8 1.18.0-8.module_el8.5.0+2608+72063365
- libiscsi AlmaLinux 8 1.18.0-8.module_el8.3.0+2048+e7a0a3ea
almalinux advisories ALSA-2020:2774ALSA-2020:1379
- netcf Rocky Linux 8 0.2.8-12.module+el8.7.0+1084+97b81f61
- netcf Rocky Linux 8 0.2.8-12.module+el8.4.0+534+4680a14e
- netcf Rocky Linux 8 0.2.8-12.module+el8.6.0+847+b490afdd
- sgabios Rocky Linux 8 1:0.20170427git-3.module+el8.7.0+1084+97b81f61
- sgabios Rocky Linux 8 1:0.20170427git-3.module+el8.4.0+534+4680a14e
- sgabios Rocky Linux 8 1:0.20170427git-3.module+el8.6.0+847+b490afdd
- libiscsi Rocky Linux 8 1.18.0-8.module+el8.7.0+1084+97b81f61
- libiscsi Rocky Linux 8 1.18.0-8.module+el8.4.0+534+4680a14e
rocky linux advisories RLSA-2020:2774RLSA-2020:1379
Is CVE-2020-8608 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2020-8608 updated cvss 5.6
QEMU: Slirp: potential OOB access due to unsafe snprintf() usages
-
Red Hat Enterprise Linux 5 kvmaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 Advanced Virtualization qemu-img, qemu-kvm, qemu-kiwi, qemu-kvm-core, qemu-kvm-tests, qemu-kvm-common, +9 moreaffected: workaround, no fix available
-
Red Hat Advanced Virtualization CodeReady Builder for RHEL 8.1.1 hivex 1.3.15-7.module+el8.1.1+5309+6d656f05, libnbd 1.0.3-1.module+el8.1.1+5659+15cacc69, netcf 0.2.8-12.module+el8.1.1+5309+6d656f05, libvirt 5.6.0-10.module+el8.1.1+5309+6d656f05, seabios 1.12.0-5.module+el8.1.1+5309+6d656f05, libiscsi 1.18.0-8.module+el8.1.1+5309+6d656f05, +44 more Red Hat Advanced Virtualization for RHEL 8.1.1 hivex 1.3.15-7.module+el8.1.1+5309+6d656f05, libnbd 1.0.3-1.module+el8.1.1+5659+15cacc69, netcf 0.2.8-12.module+el8.1.1+5309+6d656f05, nbdkit 1.12.5-2.module+el8.1.1+5309+6d656f05, libvirt 5.6.0-10.module+el8.1.1+5309+6d656f05, seabios 1.12.0-5.module+el8.1.1+5309+6d656f05, +97 morefixed: vendor fix RHSA-2020:1261
-
Red Hat CodeReady Linux Builder (v. 8) hivex 1.3.15-7.module+el8.1.0+4066+0f1aadab, netcf 0.2.8-12.module+el8.1.0+4066+0f1aadab, libvirt 4.5.0-42.module+el8.2.0+6024+15a2423f, seabios 1.11.1-4.module+el8.1.0+4066+0f1aadab, libiscsi 1.18.0-8.module+el8.1.0+4066+0f1aadab, netcf-libs 0.2.8-12.module+el8.1.0+4066+0f1aadab, +34 morefixed: vendor fix RHSA-2020:2774
-
Red Hat CodeReady Linux Builder EUS (v. 8.1) hivex 1.3.15-7.module+el8.1.0+4066+0f1aadab, netcf 0.2.8-12.module+el8.1.0+4066+0f1aadab, seabios 1.11.1-4.module+el8.1.0+4066+0f1aadab, libiscsi 1.18.0-8.module+el8.1.0+4066+0f1aadab, libvirt 4.5.0-35.3.module+el8.1.0+5931+8897e7e1, netcf-libs 0.2.8-12.module+el8.1.0+4066+0f1aadab, +34 morefixed: vendor fix RHSA-2020:2773
-
Red Hat Enterprise Linux 7 Extras slirp4netns 0.3.0-8.el7_7fixed: vendor fix RHSA-2020:0889
-
Red Hat Enterprise Linux AppStream (v. 8) udica 0.2.1-2.module+el8.1.1+4975+482d6f5d, conmon 2.0.6-1.module+el8.1.1+5259+bcdd613a, hivex 1.3.15-7.module+el8.1.0+4066+0f1aadab, nbdkit 1.4.2-5.module+el8.1.0+4066+0f1aadab, netcf 0.2.8-12.module+el8.1.0+4066+0f1aadab, podman 1.6.4-4.module+el8.1.1+5885+44006e55, +100 morefixed: vendor fix RHSA-2020:1379
-
Red Hat Enterprise Linux AppStream E4S (v. 8.0) hivex 1.3.15-7.module+el8.0.0+4084+cceb9f44, nbdkit 1.4.2-5.module+el8.0.0+4084+cceb9f44, netcf 0.2.8-11.module+el8.0.0+4084+cceb9f44, seabios 1.11.1-4.module+el8.0.0+4084+cceb9f44, libiscsi 1.18.0-7.module+el8.0.0+4084+cceb9f44, libssh2 1.8.0-8.module+el8.0.0+4084+cceb9f44.1, +82 morefixed: vendor fix RHSA-2020:3040
show 19 moreshow fewer
-
Red Hat Enterprise Linux AppStream EUS (v. 8.1) hivex 1.3.15-7.module+el8.1.0+4066+0f1aadab, nbdkit 1.4.2-5.module+el8.1.0+4066+0f1aadab, netcf 0.2.8-12.module+el8.1.0+4066+0f1aadab, seabios 1.11.1-4.module+el8.1.0+4066+0f1aadab, libiscsi 1.18.0-8.module+el8.1.0+4066+0f1aadab, supermin 5.1.19-9.module+el8.1.0+4066+0f1aadab, +81 morefixed: vendor fix RHSA-2020:2773
-
Red Hat Enterprise Linux Client (v. 7) qemu-img 1.5.3-173.el7_8.1, qemu-kvm 1.5.3-173.el7_8.1, qemu-kvm-tools 1.5.3-173.el7_8.1, qemu-kvm-common 1.5.3-173.el7_8.1 Red Hat Enterprise Linux ComputeNode Optional (v. 7) qemu-img 1.5.3-173.el7_8.1, qemu-kvm 1.5.3-173.el7_8.1, qemu-kvm-tools 1.5.3-173.el7_8.1, qemu-kvm-common 1.5.3-173.el7_8.1fixed: vendor fix RHSA-2020:1208
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) qemu-img 1.5.3-160.el7_6.7, qemu-kvm 1.5.3-160.el7_6.7, qemu-kvm-tools 1.5.3-160.el7_6.7, qemu-kvm-common 1.5.3-160.el7_6.7fixed: vendor fix RHSA-2020:2844
-
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) qemu-img 1.5.3-167.el7_7.6, qemu-kvm 1.5.3-167.el7_7.6, qemu-kvm-tools 1.5.3-167.el7_7.6, qemu-kvm-common 1.5.3-167.el7_7.6fixed: vendor fix RHSA-2020:1351
-
Red Hat Enterprise Linux Desktop (v. 6) qemu-img 0.12.1.2-2.506.el6_10.7, qemu-kvm 0.12.1.2-2.506.el6_10.7, qemu-kvm-tools 0.12.1.2-2.506.el6_10.7, qemu-guest-agent 0.12.1.2-2.506.el6_10.7 Red Hat Enterprise Linux HPC Node (v. 6) qemu-img 0.12.1.2-2.506.el6_10.7, qemu-kvm 0.12.1.2-2.506.el6_10.7, qemu-kvm-tools 0.12.1.2-2.506.el6_10.7, qemu-guest-agent 0.12.1.2-2.506.el6_10.7 Red Hat Enterprise Linux Server (v. 6) qemu-img 0.12.1.2-2.506.el6_10.7, qemu-kvm 0.12.1.2-2.506.el6_10.7, qemu-kvm-tools 0.12.1.2-2.506.el6_10.7, qemu-guest-agent 0.12.1.2-2.506.el6_10.7fixed: vendor fix RHSA-2020:1403
-
Red Hat Enterprise Linux Server (v. 7) qemu-img 1.5.3-173.el7_8.1, qemu-kvm 1.5.3-173.el7_8.1, qemu-img-ma 2.12.0-44.el7_8.1, qemu-kvm-ma 2.12.0-44.el7_8.1, qemu-kvm-tools 1.5.3-173.el7_8.1, qemu-kvm-common 1.5.3-173.el7_8.1, +2 morefixed: vendor fix RHSA-2020:1208
-
Red Hat Enterprise Linux Server EUS (v. 7.6) qemu-img 1.5.3-160.el7_6.7, qemu-kvm 1.5.3-160.el7_6.7, qemu-kvm-tools 1.5.3-160.el7_6.7, qemu-kvm-common 1.5.3-160.el7_6.7fixed: vendor fix RHSA-2020:2844
-
Red Hat Enterprise Linux Server EUS (v. 7.7) qemu-img 1.5.3-167.el7_7.6, qemu-kvm 1.5.3-167.el7_7.6, qemu-img-ma 2.12.0-33.el7_7.3, qemu-kvm-ma 2.12.0-33.el7_7.3, qemu-kvm-tools 1.5.3-167.el7_7.6, qemu-kvm-common 1.5.3-167.el7_7.6, +2 morefixed: vendor fix RHSA-2020:1351
-
Red Hat Enterprise Linux Server Optional (v. 7) qemu-kvm-ma 2.12.0-44.el7_8.1, qemu-kvm-tools-ma 2.12.0-44.el7_8.1, qemu-kvm-common-ma 2.12.0-44.el7_8.1fixed: vendor fix RHSA-2020:1209
-
Red Hat Enterprise Linux Server Optional EUS (v. 7.7) qemu-kvm-ma 2.12.0-33.el7_7.3, qemu-kvm-tools-ma 2.12.0-33.el7_7.3, qemu-kvm-common-ma 2.12.0-33.el7_7.3fixed: vendor fix RHSA-2020:1352
-
Red Hat Enterprise Linux Workstation (v. 6) qemu-img 0.12.1.2-2.506.el6_10.7, qemu-kvm 0.12.1.2-2.506.el6_10.7, qemu-kvm-tools 0.12.1.2-2.506.el6_10.7, qemu-guest-agent 0.12.1.2-2.506.el6_10.7fixed: vendor fix RHSA-2020:1403
-
Red Hat Enterprise Linux Workstation (v. 7) qemu-img 1.5.3-173.el7_8.1, qemu-kvm 1.5.3-173.el7_8.1, qemu-kvm-tools 1.5.3-173.el7_8.1, qemu-kvm-common 1.5.3-173.el7_8.1fixed: vendor fix RHSA-2020:1208
-
Red Hat OpenShift Container Platform 4.3 cri-tools 1.17.0-1.el8, toolbox 0.0.6-1.rhaos4.3.el8, dracut 049-64.git20200123.el8, jenkins 2.204.1.1581950993-1.el7, dracut-caps 049-64.git20200123.el8, dracut-live 049-64.git20200123.el8, +28 morefixed: vendor fix RHBA-2020:0527
-
Red Hat OpenStack Platform 10.0 qemu-img-rhev 2.12.0-33.el7_7.10, qemu-kvm-rhev 2.12.0-33.el7_7.10, qemu-kvm-tools-rhev 2.12.0-33.el7_7.10, qemu-kvm-common-rhev 2.12.0-33.el7_7.10fixed: vendor fix RHSA-2020:1300
-
Red Hat OpenStack Platform 13.0 qemu-img-rhev 2.12.0-44.el7_8.1, qemu-kvm-rhev 2.12.0-44.el7_8.1, qemu-kvm-tools-rhev 2.12.0-44.el7_8.1, qemu-kvm-common-rhev 2.12.0-44.el7_8.1 Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server qemu-img-rhev 2.12.0-18.el7_6.11, qemu-kvm-rhev 2.12.0-18.el7_6.11, qemu-kvm-tools-rhev 2.12.0-18.el7_6.11, qemu-kvm-common-rhev 2.12.0-18.el7_6.11fixed: vendor fix RHSA-2020:2730
-
Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts qemu-img-rhev 2.12.0-44.el7_8.1, qemu-kvm-rhev 2.12.0-44.el7_8.1, qemu-kvm-tools-rhev 2.12.0-44.el7_8.1, qemu-kvm-common-rhev 2.12.0-44.el7_8.1fixed: vendor fix RHSA-2020:1292
-
Red Hat RHV-M 4.2 qemu-img-rhev 2.12.0-18.el7_6.11, qemu-kvm-rhev 2.12.0-18.el7_6.11, qemu-kvm-tools-rhev 2.12.0-18.el7_6.11, qemu-kvm-common-rhev 2.12.0-18.el7_6.11fixed: vendor fix RHSA-2020:2342
-
Red Hat RHV-M 4.3 qemu-img-rhev 2.12.0-44.el7_8.1, qemu-kvm-rhev 2.12.0-44.el7_8.1, qemu-kvm-tools-rhev 2.12.0-44.el7_8.1, qemu-kvm-common-rhev 2.12.0-44.el7_8.1fixed: vendor fix RHSA-2020:1292
-
Red Hat Enterprise Linux 5 xen Red Hat Enterprise Linux 8 slirp4netnsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
2.49% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.6 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-120 Buffer Copy without Checking Size of Input
References
-
gitlab.freedesktop.org
/slirp/libslirp/commit/68ccb8021a838066f0951d4b2817eb6b6f10a843
patch, third-party-advisory
-
openwall.com
/lists/oss-security/2020/02/06/2
mailing-list, patch, third-party-advisory
-
usn.ubuntu.com
/4283-1/
vendor-advisory, third-party-advisory
-
security.gentoo.org
/glsa/202003-66
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-04/msg00007.html
vendor-advisory, mailing-list, third-party-advisory
-
debian.org
/security/2020/dsa-4733
vendor-advisory, third-party-advisory
-
gitlab.freedesktop.org
/slirp/libslirp/-/tags/v4.1.0
release-notes, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2020/03/msg00015.html
mailing-list, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2020/03/msg00017.html
mailing-list, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2020/07/msg00020.html
mailing-list, third-party-advisory
-
security.netapp.com
/advisory/ntap-20201001-0002/
third-party-advisory
-
lists.debian.org
/debian-lts-announce/2021/02/msg00012.html
mailing-list, third-party-advisory
Sources
- CVE List CVE-2020-8608
- NVD CVE-2020-8608
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.