Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2021:1243-1

Опубликовано: 16 апр. 2021
Источник: suse-cvrf

Описание

Security update for qemu

This update for qemu fixes the following issues:

  • CVE-2020-12829: Fix OOB access in sm501 device emulation (bsc#1172385)
  • CVE-2020-25723: Fix use-after-free in usb xhci packet handling (bsc#1178934)
  • CVE-2020-25084: Fix use-after-free in usb ehci packet handling (bsc#1176673)
  • CVE-2020-25625: Fix infinite loop (DoS) in usb hcd-ohci emulation (bsc#1176684)
  • CVE-2020-25624: Fix OOB access in usb hcd-ohci emulation (bsc#1176682)
  • CVE-2020-27617: Fix guest triggerable assert in shared network handling code (bsc#1178174)
  • CVE-2020-28916: Fix infinite loop (DoS) in e1000e device emulation (bsc#1179468)
  • CVE-2020-29443: Fix OOB access in atapi emulation (bsc#1181108)
  • CVE-2020-27821: Fix heap overflow in MSIx emulation (bsc#1179686)
  • CVE-2020-15469: Fix null pointer deref. (DoS) in mmio ops (bsc#1173612)
  • CVE-2021-20257: Fix infinite loop (DoS) in e1000 device emulation (bsc#1182577)
  • CVE-2021-3416: Fix OOB access (stack overflow) in rtl8139 NIC emulation (bsc#1182968)
  • CVE-2021-3416: Fix OOB access (stack overflow) in other NIC emulations (bsc#1182968)
  • CVE-2020-27616: Fix OOB access in ati-vga emulation (bsc#1178400)
  • CVE-2020-29129: Fix OOB access in SLIRP ARP/NCSI packet processing (bsc#1179466, CVE-2020-29130, bsc#1179467)
  • Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
  • Add split-provides through forsplits/13 to cover updates of SLE15-SP2 to SLE15-SP3, and openSUSE equivalents (bsc#1184064)
  • Added a few more usability improvements for our git packaging workflow

Список пакетов

Container suse/sles/15.2/virt-handler:0.38.1
qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1
qemu-4.2.1-11.16.3
qemu-ipxe-1.0.0+-11.16.3
qemu-seabios-1.12.1+-11.16.3
qemu-sgabios-8-11.16.3
qemu-tools-4.2.1-11.16.3
qemu-vgabios-1.12.1+-11.16.3
qemu-x86-4.2.1-11.16.3
Image SLES15-SP2-EC2-ECS-HVM
qemu-tools-4.2.1-11.16.3
SUSE Linux Enterprise Micro 5.0
qemu-4.2.1-11.16.3
qemu-arm-4.2.1-11.16.3
qemu-ipxe-1.0.0+-11.16.3
qemu-seabios-1.12.1+-11.16.3
qemu-sgabios-8-11.16.3
qemu-tools-4.2.1-11.16.3
qemu-vgabios-1.12.1+-11.16.3
qemu-x86-4.2.1-11.16.3
SUSE Linux Enterprise Module for Basesystem 15 SP2
qemu-tools-4.2.1-11.16.3
SUSE Linux Enterprise Module for Server Applications 15 SP2
qemu-4.2.1-11.16.3
qemu-arm-4.2.1-11.16.3
qemu-audio-alsa-4.2.1-11.16.3
qemu-audio-pa-4.2.1-11.16.3
qemu-block-curl-4.2.1-11.16.3
qemu-block-iscsi-4.2.1-11.16.3
qemu-block-rbd-4.2.1-11.16.3
qemu-block-ssh-4.2.1-11.16.3
qemu-guest-agent-4.2.1-11.16.3
qemu-ipxe-1.0.0+-11.16.3
qemu-kvm-4.2.1-11.16.3
qemu-lang-4.2.1-11.16.3
qemu-microvm-4.2.1-11.16.3
qemu-ppc-4.2.1-11.16.3
qemu-s390-4.2.1-11.16.3
qemu-seabios-1.12.1+-11.16.3
qemu-sgabios-8-11.16.3
qemu-ui-curses-4.2.1-11.16.3
qemu-ui-gtk-4.2.1-11.16.3
qemu-ui-spice-app-4.2.1-11.16.3
qemu-vgabios-1.12.1+-11.16.3
qemu-x86-4.2.1-11.16.3

Ссылки

Описание

In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки

Описание

In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки

Описание

QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки

Описание

hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки

Описание

hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки

Описание

A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки

Описание

ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки

Описание

eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки

Описание

A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service. This flaw affects QEMU versions prior to 5.2.0.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки

Описание

hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки

Описание

ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки

Описание

slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки

Описание

ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки

Описание

An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки

Описание

A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.

Затронутые продукты
Container suse/sles/15.2/virt-handler:0.38.1:qemu-tools-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-4.2.1-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-ipxe-1.0.0+-11.16.3
Container suse/sles/15.2/virt-launcher:0.38.1:qemu-seabios-1.12.1+-11.16.3
Ссылки
Уязвимость SUSE-SU-2021:1243-1