Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:2877-1

Опубликовано: 07 окт. 2020
Источник: suse-cvrf

Описание

Security update for qemu

This update for qemu fixes the following issues:

  • CVE-2020-14364: Fixed an OOB access while processing USB packets (bsc#1175441,bsc#1176494).
  • CVE-2020-16092: Fixed a denial of service in packet processing of various emulated NICs (bsc#1174641).
  • CVE-2020-15863: Fixed a buffer overflow in the XGMAC device (bsc#1174386).
  • CVE-2020-24352: Fixed an out-of-bounds read/write in ati-vga device emulation in ati_2d_blt (bsc#1175370).
  • Allow to IPL secure guests with -no-reboot (bsc#1174863)

Список пакетов

Container suse/sles/15.2/virt-handler:0.38.1
qemu-tools-4.2.1-11.10.1
Container suse/sles/15.2/virt-launcher:0.38.1
qemu-4.2.1-11.10.1
qemu-ipxe-1.0.0+-11.10.1
qemu-seabios-1.12.1+-11.10.1
qemu-sgabios-8-11.10.1
qemu-tools-4.2.1-11.10.1
qemu-vgabios-1.12.1+-11.10.1
qemu-x86-4.2.1-11.10.1
Image SLES15-SP2-EC2-ECS-HVM
qemu-tools-4.2.1-11.10.1
SUSE Linux Enterprise Module for Basesystem 15 SP2
qemu-tools-4.2.1-11.10.1
SUSE Linux Enterprise Module for Server Applications 15 SP2
qemu-4.2.1-11.10.1
qemu-arm-4.2.1-11.10.1
qemu-audio-alsa-4.2.1-11.10.1
qemu-audio-pa-4.2.1-11.10.1
qemu-block-curl-4.2.1-11.10.1
qemu-block-iscsi-4.2.1-11.10.1
qemu-block-rbd-4.2.1-11.10.1
qemu-block-ssh-4.2.1-11.10.1
qemu-guest-agent-4.2.1-11.10.1
qemu-ipxe-1.0.0+-11.10.1
qemu-kvm-4.2.1-11.10.1
qemu-lang-4.2.1-11.10.1
qemu-microvm-4.2.1-11.10.1
qemu-ppc-4.2.1-11.10.1
qemu-s390-4.2.1-11.10.1
qemu-seabios-1.12.1+-11.10.1
qemu-sgabios-8-11.10.1
qemu-ui-curses-4.2.1-11.10.1
qemu-ui-gtk-4.2.1-11.10.1
qemu-ui-spice-app-4.2.1-11.10.1
qemu-vgabios-1.12.1+-11.10.1
qemu-x86-4.2.1-11.10.1

Ссылки

Описание

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.10.1
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.10.1
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.10.1
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.10.1
Ссылки

Описание

hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential privileged code execution. This was fixed in commit 5519724a13664b43e225ca05351c60b4468e4555.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.10.1
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.10.1
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.10.1
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.10.1
Ссылки

Описание

In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.10.1
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.10.1
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.10.1
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.10.1
Ссылки

Описание

An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.10.1
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.10.1
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.10.1
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.10.1
Ссылки
Уязвимость SUSE-SU-2020:2877-1