CVE-2020-14364 : arbitrary code execution in QEMU

[Te-k]

Hi,

CVE-2020-14364 apparently allows arbitrary code execution in QEMU in versions before 5.2.0. Pyrebox QEMU fork seem to be in version 4.0.0. Is it vulnerable to this issue?

References :

• Red Hat bug tracker
• Debian bug tracker
• patch
• video of the exploitation

[xabiugarte]

Hi Te-k,

We are planning to upgrade the QEMU version soon. I will close this issue once the upgrade is done.

Thanks a lot for the heads up!