Skip to content
OpenAdvisories
Unscored CVE-2020-10756 EUVD-2020-3173

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_se…

Published Jul 9, 2020 · Updated Aug 4, 2024 · Assigned by redhat

Description

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1.

Affected products

VendorProductAffectedFixed
— Slirp All libslirp versions before 4.3.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libslirp 4.3.1-1 —
Debian 14 qemu 1:4.1-2 —
Debian 14 slirp4netns 1.0.1-1 —
Debian 13 libslirp 4.3.1-1 —
Debian 13 qemu 1:4.1-2 —
Debian 13 slirp4netns 1.0.1-1 —
Debian 12 libslirp 4.3.1-1 —
Debian 12 qemu 1:4.1-2 —
Debian 12 slirp4netns 1.0.1-1 —
Debian 10 qemu 1:3.1+dfsg-8+deb10u6 DSA-4728-1
Debian 9 qemu 1:2.8+dfsg-6+deb9u10 DLA-2288-1
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS libslirp 4.1.0-2ubuntu2.1 USN-4437-1
Ubuntu 20.04 LTS qemu 1:4.2-3ubuntu6.4 USN-4467-1
Ubuntu 20.04 LTS slirp4netns No fix yet —
Ubuntu 18.04 LTS qemu 1:2.11+dfsg-1ubuntu7.31 USN-4467-1
Ubuntu 16.04 LTS qemu 1:2.5+dfsg-5ubuntu10.45 USN-4467-1
ReleasePackageFixed inAdvisory
RHEL 8 SLOF 20171214-6.gitfa98132.module+el8.1.0+4066+0f1aadab RHSA-2020:4059, RHSA-2020:3586
RHEL 8 buildah +1 1.15.1-2.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 cockpit-podman 18.1-2.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 conmon 2:2.0.20-2.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 container-selinux 2:2.144.0-1.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 containernetworking-plugins 0.8.6-2.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 crit +2 3.14-2.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 crun 0.14.1-2.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 fuse-overlayfs +1 1.1.2-3.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 hivex +6 1.3.15-7.module+el8.1.0+4066+0f1aadab RHSA-2020:4059, RHSA-2020:3586
RHEL 8 libguestfs-winsupport 8.0-4.module+el8.1.0+4066+0f1aadab RHSA-2020:4059, RHSA-2020:3586
RHEL 8 libiscsi +2 1.18.0-8.module+el8.1.0+4066+0f1aadab RHSA-2020:4059, RHSA-2020:3586
RHEL 8 libnbd +5 1.2.2-1.module+el8.2.0+5644+32ac38d4 RHSA-2020:3586
RHEL 8 libslirp +1 4.3.1-1.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 libtpms +1 0.7.0-1.20191018gitdc116933b7.module+el8.2.0+4793+b09dd2fb RHSA-2020:3586
RHEL 8 libvirt +27 4.5.0-42.module+el8.2.0+6024+15a2423f RHSA-2020:4059, RHSA-2020:3586
RHEL 8 libvirt-daemon-driver-storage-iscsi-direct 6.0.0-25.2.module+el8.2.1+7722+a9e38cf3 RHSA-2020:3586
RHEL 8 libvirt-dbus 1.2.0-3.module+el8.1.0+4066+0f1aadab RHSA-2020:4059, RHSA-2020:3586
RHEL 8 libvirt-python +1 4.5.0-2.module+el8.1.0+4066+0f1aadab RHSA-2020:4059, RHSA-2020:3586
RHEL 8 nbdkit +9 1.4.2-5.module+el8.1.0+4066+0f1aadab RHSA-2020:4059, RHSA-2020:3586
RHEL 8 nbdkit-server +8 1.16.2-4.module+el8.2.1+6710+effcb1df RHSA-2020:3586
RHEL 8 netcf +2 0.2.8-12.module+el8.1.0+4066+0f1aadab RHSA-2020:4059, RHSA-2020:3586
RHEL 8 perl-Sys-Virt 4.5.0-5.module+el8.1.0+4066+0f1aadab RHSA-2020:4059, RHSA-2020:3586
RHEL 8 podman +4 2.0.5-5.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 python-podman-api 1.2.0-0.2.gitd0a45fe.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 python-pyvmomi +1 6.7.1-7.module+el8.2.0+4793+b09dd2fb RHSA-2020:3586
RHEL 8 qemu-img +10 15:2.12.0-99.module+el8.2.0+7988+c1d02dbb.4 RHSA-2020:4059, RHSA-2020:3586
RHEL 8 runc 1.0.0-68.rc92.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 seabios +2 1.11.1-4.module+el8.1.0+4066+0f1aadab RHSA-2020:4059, RHSA-2020:3586
RHEL 8 sgabios +1 1:0.20170427git-3.module+el8.1.0+4066+0f1aadab RHSA-2020:4059, RHSA-2020:3586
RHEL 8 skopeo +2 1:1.1.1-3.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 slirp4netns 1.1.4-2.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 supermin +1 5.1.19-9.module+el8.1.0+4066+0f1aadab RHSA-2020:4059, RHSA-2020:3586
RHEL 8 swtpm +3 0.2.0-2.20200127gitff5a83b.module+el8.2.0+5579+d71178e0 RHSA-2020:3586
RHEL 8 toolbox 0.0.8-1.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 udica 0.2.2-1.module+el8.3.0+8221+97165c3f RHSA-2020:4694
RHEL 8 virglrenderer +2 0.8.2-1.module+el8.2.0+5777+d9c2af8c RHSA-2020:3586
RHEL 8 virt-dib +25 1:1.38.4-15.module+el8.2.0+5297+222a20af RHSA-2020:4059, RHSA-2020:3586

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 hivex +6 1.3.18-20.module_el8.3.0+2048+e7a0a3ea ALSA-2021:1064
AlmaLinux 8 libguestfs-winsupport 8.2-1.module_el8.3.0+2048+e7a0a3ea ALSA-2021:1064
AlmaLinux 8 libiscsi +2 1.18.0-8.module_el8.3.0+2048+e7a0a3ea ALSA-2021:1064, ALSA-2020:4059
AlmaLinux 8 libnbd +5 1.2.2-1.module_el8.3.0+2048+e7a0a3ea ALSA-2021:1064
AlmaLinux 8 libslirp +1 4.3.1-1.module_el8.6.0+2876+9ed4eae2 ALSA-2020:4694
AlmaLinux 8 libvirt-dbus 1.3.0-2.module_el8.3.0+2048+e7a0a3ea ALSA-2021:1064
AlmaLinux 8 nbdkit +13 1.16.2-4.module_el8.5.0+2608+72063365 ALSA-2021:1064
AlmaLinux 8 netcf +2 0.2.8-12.module_el8.3.0+2048+e7a0a3ea ALSA-2021:1064, ALSA-2020:4059
AlmaLinux 8 ocaml-libguestfs +1 1:1.40.2-25.module_el8.3.0+2048+e7a0a3ea.alma ALSA-2021:1064
AlmaLinux 8 perl-Sys-Virt +1 6.0.0-1.module_el8.3.0+2048+e7a0a3ea ALSA-2021:1064
AlmaLinux 8 python-podman-api 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455 ALSA-2020:4694
AlmaLinux 8 seabios +2 1.13.0-2.module_el8.5.0+2608+72063365 ALSA-2021:1064
AlmaLinux 8 sgabios 1:0.20170427git-3.module_el8.3.0+2048+e7a0a3ea ALSA-2021:1064, ALSA-2020:4059
AlmaLinux 8 sgabios-bin 1:0.20170427git-3.module_el8.5.0+2608+72063365 ALSA-2021:1064, ALSA-2020:4059
AlmaLinux 8 supermin +1 5.1.19-10.module_el8.5.0+2608+72063365 ALSA-2021:1064

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 libiscsi 1.18.0-8.module+el8.4.0+534+4680a14e RLSA-2020:4059
Rocky Linux 8 libslirp 4.3.1-1.module+el8.4.0+556+40122d08 RLSA-2020:4694
Rocky Linux 8 netcf 0.2.8-12.module+el8.4.0+534+4680a14e RLSA-2020:4059
Rocky Linux 8 python-podman-api 1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2 RLSA-2020:4694
Rocky Linux 8 sgabios 1:0.20170427git-3.module+el8.4.0+534+4680a14e RLSA-2020:4059
Rocky Linux 8 toolbox 0.0.8-1.module+el8.4.0+556+40122d08 RLSA-2020:4694
ReleasePackageFixed inAdvisory
SLES 15 SP2 qemu 3.1.1.1-9.27.2 SUSE-SU-2021:1918-1, SUSE-SU-2021:1893-1
SLES 15 SP2 slirp4netns 0.4.7-3.12.1 SUSE-SU-2020:1915-1
SLES 15 SP1 qemu 3.1.1.1-9.27.2 SUSE-SU-2021:1918-1
SLES 15 SP1 slirp4netns 0.4.7-3.12.1 SUSE-SU-2020:1915-1
SLES 15 qemu 2.11.2-9.46.1 SUSE-SU-2021:1895-1
SLES 12 SP5 qemu 3.1.1.1-51.1 SUSE-SU-2021:1837-1
SLES 12 SP4 qemu 2.11.2-5.32.1 SUSE-SU-2021:1947-1
Show 19 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP3 qemu 2.9.1-6.50.1 SUSE-SU-2021:1894-1
SLES 12 SP2 qemu 2.6.2-41.65.1 SUSE-SU-2021:1829-1
SLES for SAP 15 SP1 qemu 3.1.1.1-9.27.2 SUSE-SU-2021:1918-1
SLES for SAP 15 qemu 2.11.2-9.46.1 SUSE-SU-2021:1895-1
SLES for SAP 12 SP5 qemu 3.1.1.1-51.1 SUSE-SU-2021:1837-1
SLES for SAP 12 SP4 qemu 2.11.2-5.32.1 SUSE-SU-2021:1947-1
SLES for SAP 12 SP3 qemu 2.9.1-6.50.1 SUSE-SU-2021:1894-1
SLE Micro 5.0 qemu 4.2.1-11.19.2 SUSE-SU-2021:1893-1
SLE HPC 15 SP1 qemu 3.1.1.1-9.27.2 SUSE-SU-2021:1918-1
SLE HPC 15 qemu 2.11.2-9.46.1 SUSE-SU-2021:1895-1
SUSE OpenStack Cloud Crowbar 9 qemu 2.11.2-5.32.1 SUSE-SU-2021:1947-1
SUSE OpenStack Cloud Crowbar 8 qemu 2.9.1-6.50.1 SUSE-SU-2021:1894-1
SUSE OpenStack Cloud 9 qemu 2.11.2-5.32.1 SUSE-SU-2021:1947-1
SUSE OpenStack Cloud 8 qemu 2.9.1-6.50.1 SUSE-SU-2021:1894-1
SUSE Manager Server 4.0 qemu 3.1.1.1-9.27.2 SUSE-SU-2021:1918-1
SUSE Manager Retail Branch Server 4.0 qemu 3.1.1.1-9.27.2 SUSE-SU-2021:1918-1
SUSE Manager Proxy 4.0 qemu 3.1.1.1-9.27.2 SUSE-SU-2021:1918-1
SUSE HPE Helion OpenStack 8 qemu 2.9.1-6.50.1 SUSE-SU-2021:1894-1
SUSE Enterprise Storage 6 qemu 3.1.1.1-9.27.2 SUSE-SU-2021:1918-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libslirp 4.6.1+7-1.2 openSUSE-SU-2024:10991-1
openSUSE Leap 15.2 qemu 4.2.1-lp152.9.16.2 openSUSE-SU-2021:1043-1
openSUSE Leap 15.2 qemu-linux-user 4.2.1-lp152.9.16.1 openSUSE-SU-2021:1043-1
openSUSE Leap 15.2 qemu-testsuite 4.2.1-lp152.9.16.7 openSUSE-SU-2021:1043-1
openSUSE Leap 15.2 slirp4netns 0.4.7-lp152.2.3.1 openSUSE-SU-2020:0994-1
openSUSE Leap 15.1 slirp4netns 0.4.7-lp151.2.12.1 openSUSE-SU-2020:0987-1
ReleasePackageFixed inAdvisory
Alpine v3.24 libslirp 4.3.1-r0 —
Alpine v3.23 libslirp 4.3.1-r0 —
Alpine v3.22 libslirp 4.3.1-r0 —
Alpine v3.21 libslirp 4.3.1-r0 —
Alpine v3.20 libslirp 4.3.1-r0 —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 libslirp 4.3.1-r0 —
Alpine v3.18 libslirp 4.3.1-r0 —
Alpine v3.17 libslirp 4.3.1-r0 —
Alpine v3.16 libslirp 4.3.1-r0 —
Alpine v3.15 libslirp 4.3.1-r0 —
Alpine v3.14 libslirp 4.3.1-r0 —
Alpine v3.13 libslirp 4.3.1-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 qemu +26 10:3.1.0-8.amzn2.0.6 ALAS2-2020-1570

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 buildah +1 1.15.1-2.0.1.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 cockpit-podman 18.1-2.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 conmon 2:2.0.20-2.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 container-selinux 2:2.144.0-1.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 containernetworking-plugins 0.8.6-2.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 crit +2 3.14-2.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 crun 0.14.1-2.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 fuse-overlayfs +1 1.1.2-3.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 hivex +6 1.3.15-7.module+el8.2.0+5598+5fbb295f ELSA-2020-4059
Oracle Linux 8 libguestfs-winsupport 8.0-4.module+el8.2.0+5598+5fbb295f ELSA-2020-4059
Oracle Linux 8 libiscsi +2 1.18.0-8.module+el8.2.0+5598+5fbb295f ELSA-2020-4059
Oracle Linux 8 libslirp +1 4.3.1-1.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 libvirt +27 4.5.0-42.0.1.module+el8.2.0+5598+5fbb295f ELSA-2020-4059
Oracle Linux 8 libvirt-dbus 1.2.0-3.module+el8.2.0+5598+5fbb295f ELSA-2020-4059
Oracle Linux 8 nbdkit +9 1.4.2-5.module+el8.2.0+5598+5fbb295f ELSA-2020-4059
Oracle Linux 8 netcf +2 0.2.8-12.module+el8.2.0+5598+5fbb295f ELSA-2020-4059
Oracle Linux 8 perl-Sys-Virt 4.5.0-5.module+el8.2.0+5598+5fbb295f ELSA-2020-4059
Oracle Linux 8 podman +4 2.0.5-5.0.1.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 python-podman-api 1.2.0-0.2.gitd0a45fe.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 python3-libvirt 4.5.0-2.module+el8.2.0+5598+5fbb295f ELSA-2020-4059
Oracle Linux 8 qemu-img +10 15:2.12.0-99.0.1.module+el8.2.0+7798+88bea828.4 ELSA-2020-4059
Oracle Linux 8 runc 1.0.0-68.rc92.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 seabios +2 1.11.1-4.module+el8.2.0+5598+5fbb295f ELSA-2020-4059
Oracle Linux 8 sgabios +1 1:0.20170427git-3.module+el8.2.0+5598+5fbb295f ELSA-2020-4059
Oracle Linux 8 skopeo +2 1:1.1.1-3.0.1.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 slirp4netns 1.1.4-2.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 supermin +1 5.1.19-9.module+el8.2.0+5598+5fbb295f ELSA-2020-4059
Oracle Linux 8 udica 0.2.2-1.module+el8.3.0+7866+f387f528 ELSA-2020-4694
Oracle Linux 8 virt-dib +25 1:1.38.4-15.0.1.module+el8.2.0+5598+5fbb295f ELSA-2020-4059
Oracle Linux 7 qemu +12 15:4.2.1-4.el7 ELSA-2021-9034

Advisories 30

References