CVE-2020-25624: 
NixOS vulnerability analysis and mitigation

A stack-based buffer over-read vulnerability was discovered in QEMU version 5.0.0, specifically in the hw/usb/hcd-ohci.c component. The vulnerability was identified and disclosed in September 2020, affecting the USB OHCI controller emulator. The issue occurs when processing values obtained from the host controller driver (MITRE CVE, NVD).

The vulnerability exists in the OHCI (Open Host Controller Interface) implementation where the host controller derives variables like 'start_addr', 'end_addr', and 'len' from values supplied by the host controller driver. When servicing the OHCI transfer descriptors (TD), these values can lead to out-of-bounds access issues if not properly validated. The vulnerability has been assigned a CVSS v3.1 base score of 5.0 (Medium) with the vector string CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L (QEMU Patch).

The successful exploitation of this vulnerability could lead to disclosure of sensitive information or result in a Denial of Service (DoS) condition. The vulnerability allows an attacker to potentially access memory outside of intended boundaries through the USB OHCI controller emulation (NetApp Advisory).

The vulnerability requires local access with high privileges and high attack complexity to exploit. The issue was discovered during security testing when processing specific values through the OHCI host controller driver, which could trigger an out-of-bounds read condition (QEMU Patch).

A patch was developed to add proper validation checks for the 'len' and 'frame_number' variables in the OHCI implementation. The fix includes additional boundary checks to prevent out-of-bounds access and ensures proper validation of buffer sizes. The patch was submitted and integrated into subsequent QEMU versions (QEMU Patch).