Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2021:14706-1

Опубликовано: 23 апр. 2021
Источник: suse-cvrf

Описание

Security update for kvm

This update for kvm fixes the following issues:

  • Fix OOB read and write due to integer overflow in sm501_2d_operation() in hw/display/sm501.c (CVE-2020-12829, bsc#1172385)
  • Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)
  • Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)
  • Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)
  • Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)
  • Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)
  • Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)
  • Fix DoS in e1000 emulated device (CVE-2021-20257 bsc#1182577)
  • Fix OOB access in SLIRP ARP packet processing (CVE-2020-29130, bsc#1179467)
  • Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441)
  • Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)
  • Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
  • Fix use-after-free in slirp (CVE-2019-15890 bsc#1149811)
  • Fix for similar problems as for the original fix prompting this issue (CVE-2019-6778 bsc#1123156)
  • Fix potential OOB accesses in slirp (CVE-2020-8608 bsc#1163018 CVE-2020-7039 bsc#1161066)
  • Fix use after free in slirp (CVE-2020-1983 bsc#1170940)
  • Fix potential DOS in lsi scsi controller emulation (CVE-2019-12068 bsc#1146873)
  • Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384)
  • Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)

Список пакетов

SUSE Linux Enterprise Point of Sale 11 SP3
kvm-1.4.2-53.38.1

Ссылки

Описание

The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки

Описание

An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Затронутые продукты
SUSE Linux Enterprise Point of Sale 11 SP3:kvm-1.4.2-53.38.1
Ссылки
Уязвимость SUSE-SU-2021:14706-1