CVE-2020-11102 – hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of

hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the frame size is not validated against the r/w data length.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11102

Reference (s):

• http://www.openwall.com/lists/oss-security/2020/04/06/1
• GENTOO:GLSA-202005-02
• URL: https://security.gentoo.org/glsa/202005-02
• https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg08322.html
• MLIST:[oss-security] 20200406 CVE-2020-11102 QEMU: tulip: OOB access in tulip_copy_tx_buffers