CVE-2020-13659: 
NixOS vulnerability analysis and mitigation

A NULL pointer dereference vulnerability was discovered in QEMU version 4.2.0, specifically in the address_space_map function within exec.c. The vulnerability is related to the MegaRAID SAS 8708EM2 emulator and occurs when mapping physical memory into host's virtual address space. The issue was assigned CVE-2020-13659 and was discovered by Alexander Bulekov (OSS Security).

The vulnerability occurs because the address_space_map() API may return NULL without setting the length parameter to zero when BounceBuffer is in use. This technical issue specifically affects the memory mapping operations in the MegaRAID SAS 8708EM2 emulator component of QEMU (OSS Security, QEMU Patch).

When successfully exploited, this vulnerability could lead to a denial of service (DoS) condition by causing the QEMU process to crash on the host system. The vulnerability has been assigned a CVSS v3.1 base score of 2.5 (Low) with the vector string CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L (Ubuntu Security).

The vulnerability can be exploited by a guest user or process to trigger a NULL pointer dereference, which results in a crash of the QEMU process on the host system. The attack requires local access with high privileges and high attack complexity (Ubuntu Security).

The vulnerability has been fixed in multiple distributions through security updates. Ubuntu has released fixes in versions 1:4.2-3ubuntu6.4 for 20.04 LTS, 1:2.11+dfsg-1ubuntu7.31 for 18.04 LTS, and 1:2.5+dfsg-5ubuntu10.45 for 16.04 LTS. Debian has addressed the issue in version 1:3.1+dfsg-8+deb10u6 for the stable distribution (buster). Users are recommended to upgrade their QEMU packages to the fixed versions (Ubuntu USN, Debian Security).