CVE-2020-10702 - CVE House
Back to Database
Status published Medium CVE-2020-10702

A flaw was found in QEMU in the implementation of...

Vulnerability Description

A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-10702

Credits & Attribution

No credits recorded in the NVD database.

References

More from The QEMU Project

View All →
CVE-2020-10717
A potential DoS flaw was found in the virtio-fs shared...
Low 3.3
CVE-2019-3812
QEMU, through version 2.10 and through version 3.1.0, is vulnerable...
Medium 4.4
CVE-2018-10839
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation...
Medium 6.5

Affected Vendor

The QEMU Project

View all reports →

Affected Software

qemu
Vulnerable Versions:
>= 4.0.0, < 5.0.0

Timeline

Official Publish: June 4th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-325

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.