CVE-2020-25742

NameCVE-2020-25742
Descriptionpci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs971390

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qemu (PTS)bullseye1:5.2+dfsg-11+deb11u3vulnerable
bullseye (security)1:5.2+dfsg-11+deb11u2vulnerable
bookworm1:7.2+dfsg-7+deb12u7vulnerable
sid, trixie1:9.1.2+ds-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
qemusource(unstable)(unfixed)971390

Notes

[bookworm] - qemu <postponed> (Minor issue, revisit when fixed upstream)
[bullseye] - qemu <postponed> (Minor issue, revisit when fixed upstream)
[buster] - qemu <postponed> (Minor issue, waiting for sanctioned patch)
https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05294.html
https://patchew.org/QEMU/20200827114917.1851111-1-ppandit@redhat.com/
https://ruhr-uni-bochum.sciebo.de/s/NNWP2GfwzYKeKwE?path=%2Flsi_nullptr1
No sanctioned upstream patch as of 2024-08-06

Search for package or bug name: Reporting problems