CVE-2020-35505: 
NixOS vulnerability analysis and mitigation

A NULL pointer dereference vulnerability (CVE-2020-35505) was discovered in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. The vulnerability was found in the do_busid_cmd() function in hw/scsi/esp.c while handling the 'Information Transfer' command (CMD_TI). The issue was discovered by Cheolwoo Myung and was fixed in QEMU version 6.0.0 (NVD, Ubuntu).

The vulnerability occurs because the do_busid_cmd() function does not ensure that 's->current_dev' is a valid pointer to SCSIDevice. This pointer is used to access the 's->current_dev->id' field when finding a SCSI device through scsi_device_find(). The vulnerability has a CVSS v3.1 base score of 4.4 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (NetApp Security).

When successfully exploited, this vulnerability allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability (Ubuntu, Red Hat Bugzilla).

The vulnerability requires local access and high privileges to exploit. A proof-of-concept exploit is available in the Launchpad bug tracker. The vulnerability can be triggered by a privileged guest user while handling the 'Information Transfer' command (Red Hat Bugzilla).

The vulnerability was fixed in QEMU version 6.0.0. The specific fix was implemented in the commit 99545751734035b76bd372c4e7215bb337428d89. Users are advised to upgrade to QEMU version 6.0.0 or later to address this vulnerability. For systems that cannot be immediately upgraded, no alternative workarounds are available (OSS Security).