CVE-2020-13253: 
NixOS vulnerability analysis and mitigation

An out-of-bounds read access vulnerability was discovered in the SD Memory Card emulator of QEMU 4.2.0, identified as CVE-2020-13253. The vulnerability was discovered in May 2020 and affects the sd_wp_addr function in hw/sd/sd.c. The issue occurs when performing block write commands via sdhci_write() operations, where an unvalidated address leads to an out-of-bounds read (NIST NVD, OpenWall).

The vulnerability stems from the sd_wp_addr function in hw/sd/sd.c where the code uses an unvalidated address derived from 's->data_start'. When performing block write commands via sdhci_write(), if a guest user sends an address which is out-of-bounds of 's->wp_groups', it results in an out-of-bounds read. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NIST NVD).

The vulnerability allows a guest OS user to crash the QEMU process, resulting in a denial of service (DoS) condition. The impact is limited to availability with no direct impact on confidentiality or integrity of the system (NIST NVD, Ubuntu Security).

The vulnerability requires local access with low attack complexity. An attacker needs to be a guest user/process to exploit this vulnerability by sending specifically crafted addresses during block write commands. The vulnerability has been confirmed to be exploitable, with proof-of-concept code available (OpenWall).

The vulnerability has been patched in various distributions. Ubuntu has released fixes in versions 1:4.2-3ubuntu6.4 for Ubuntu 20.04, 1:2.11+dfsg-1ubuntu7.31 for Ubuntu 18.04, and 1:2.5+dfsg-5ubuntu10.45 for Ubuntu 16.04. Debian has addressed the issue in version 1:2.8+dfsg-6+deb9u11 for Debian 9 stretch and 1:3.1+dfsg-8+deb10u9 for Debian 10 buster. Gentoo has fixed the vulnerability in version 5.1.0-r1 (Ubuntu Security, Debian LTS, Gentoo Security).