hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the frame size is not validated against the r/w data length.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11102
Reference (s):
- http://www.openwall.com/lists/oss-security/2020/04/06/1
- GENTOO:GLSA-202005-02
- URL: https://security.gentoo.org/glsa/202005-02
- https://lists.gnu.org/archive/html/qemu-devel/2020-03/msg08322.html
- MLIST:[oss-security] 20200406 CVE-2020-11102 QEMU: tulip: OOB access in tulip_copy_tx_buffers