VDB
DEBIAN-CVE-2020-35503
DEBIAN-CVE-2020-35503
PUBLISHED
CVSS 6 MEDIUM
A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. This issue occurs in the megasas_command_cancelled() callback function while dropping a SCSI request. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Risk Scores
CVSS 3.1
6
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:11 | qemu | 1:9.2.0~rc0+ds-1, 0, 10.0.0+ds |
| Debian:14 | qemu | 1:10.1.0+ds-3, *, 1:10.1.0+ds-5 |
| Debian:13 | qemu | 1:10.1.2+ds-3, 1:10.2.0+ds-1, 1:10.2.0+ds-2 |
| Debian:12 | qemu | 1:10.2.2+ds-1, 1:11.0.0+ds-1, 1:11.0.0~rc1+ds-1 |
Timeline
- Jun 2, 2021 CVE Published
- Apr 28, 2026 CVE Updated