Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 716518 (CVE-2020-11102) - <app-emulation/qemu-4.2.0-r3: Buffer overflow in hw/net/tulip.c (CVE-2020-11102)
Summary: <app-emulation/qemu-4.2.0-r3: Buffer overflow in hw/net/tulip.c (CVE-2020-11102)
Alias: CVE-2020-11102
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B2 [glsa+ cve]
Depends on: 717176
  Show dependency tree
Reported: 2020-04-07 06:52 UTC by filip ambroz
Modified: 2020-05-12 23:33 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---
nattka: sanity-check-


Note You need to log in before you can comment on or make changes to this bug.
Description filip ambroz 2020-04-07 06:52:48 UTC
An out-of-bounds access issue was found in the Tulip NIC emulator built into 
QEMU. It could occur while copying network data to/from its tx/rx frame 
buffers, as it does not check frame size against the data length.

A remote user/process could use this flaw to crash the QEMU process resulting 
in Dos OR potentially execute arbitrary code with the privileges of the QEMU 
process on the host.

Upstream Patch:;a=commit;h=8ffb7265af64ec81748335ec8f20e7ab542c3850

Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-07 06:56:15 UTC
Thanks for this, I saw it and had it open to report. Not sure what happened there...

@maintainer(s), please create an appropriate ebuild.
Comment 2 Larry the Git Cow gentoo-dev 2020-04-08 18:51:31 UTC
The bug has been referenced in the following commit(s):

commit 5ba2de3e653a5476467ef25d3389118f49d3f9ac
Author:     Matthias Maier <>
AuthorDate: 2020-04-08 18:50:34 +0000
Commit:     Matthias Maier <>
CommitDate: 2020-04-08 18:51:16 +0000

    app-emulation/qemu: fix buffer overflow, CVE-2020-11102
    Package-Manager: Portage-2.3.96, Repoman-2.3.22
    Signed-off-by: Matthias Maier <>

 .../qemu/files/qemu-4.2.0-CVE-2020-11102.patch     | 144 ++++
 app-emulation/qemu/qemu-4.2.0-r3.ebuild            | 835 +++++++++++++++++++++
 2 files changed, 979 insertions(+)
Comment 3 Agostino Sarubbo gentoo-dev 2020-04-13 15:52:49 UTC
This is an automatic message.

I'm getting test-failure(s) (that were already reported) on amd64. If you want the package to pass my CI environment and got stabilized, please carry out the necessary operations to make sure that src_test() won't fail.
Comment 4 NATTkA bot gentoo-dev 2020-04-18 22:08:36 UTC
Unable to check for sanity:

> no match for package: app-emulation/qemu-4.2.0-r3
Comment 5 GLSAMaker/CVETool Bot gentoo-dev 2020-05-12 23:33:38 UTC
This issue was resolved and addressed in
 GLSA 202005-02 at
by GLSA coordinator Thomas Deutschmann (whissi).