CVE-2020-25742: 
NixOS vulnerability analysis and mitigation

CVE-2020-25742 is a NULL pointer dereference vulnerability discovered in QEMU versions before 5.1.1. The vulnerability exists in the pci_change_irq_level function within hw/pci/pci.c, specifically in the LSI53C895A SCSI Host Bus Adapter emulator component. The issue occurs because pci_get_bus() might not return a valid pointer, leading to potential NULL pointer dereference (Openwall Mailing List, NVD).

The vulnerability manifests during the processing of 'Memory Move' instructions when moving data between DMA memory and I/O address space via the lsi_memcpy() function. The issue stems from the pci_change_irq_level function not properly validating the return value of pci_get_bus() before dereferencing it. The vulnerability has been assigned a CVSS v3.1 Base Score of 3.2 (LOW) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L (NVD).

If exploited, this vulnerability could allow a guest user or process to crash the QEMU process on the host system, resulting in a Denial of Service (DoS) scenario (Openwall Mailing List).

The vulnerability requires local access with high privileges to exploit. The attack complexity is low, and no user interaction is required. The vulnerability has been classified as a NULL Pointer Dereference (CWE-476) (NVD).

The vulnerability was fixed in QEMU version 5.1.1. Users are advised to upgrade to this version or later to address the issue. A patch was proposed that adds a check for the bus pointer before dereferencing it in the pci_change_irq_level function (QEMU Patch).

The vulnerability was discovered and reported by security researchers Sergej Schumilo, Cornelius Aschermann, and Simon Wrner from Ruhr-University Bochum (Openwall Mailing List).