CVE-2020-35505
Publication date 28 May 2021
Last updated 28 October 2026
Ubuntu priority
Description
A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| qemu-kvm | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| qemu | 26.10 stonking |
Fixed in 1:6.0+dfsg-1~ubuntu3
|
| 26.04 LTS resolute |
Fixed in 1:6.0+dfsg-1~ubuntu3
|
|
| 24.04 LTS noble |
Fixed in 1:6.0+dfsg-1~ubuntu3
|
|
| 22.04 LTS jammy |
Fixed in 1:6.0+dfsg-1~ubuntu3
|
|
| 20.04 LTS focal |
Fixed in 1:4.2-3ubuntu6.17
|
|
| 18.04 LTS bionic |
Fixed in 1:2.11+dfsg-1ubuntu7.37
|
|
| 16.04 LTS xenial |
Fixed in 1:2.5+dfsg-5ubuntu10.51+esm4
|
|
| 14.04 LTS trusty |
Fixed in 2.0.0+dfsg-2ubuntu1.47+esm6
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
Patch details
Severity score breakdown
CVSS version: CVSS v3.0
Base score
4.4 · Medium
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-5010-1
- QEMU vulnerabilities
- 15 July 2021
- USN-8412-1
- QEMU vulnerabilities
- 9 June 2026