Описание
Security update for qemu
This update for qemu fixes the following issues:
- Switch method of splitting off hw-s390x-virtio-gpu-ccw.so as a module to what was accepted upstream (bsc#1181103)
- Fix OOB access in sdhci interface (CVE-2020-17380, bsc#1175144, CVE-2020-25085, bsc#1176681, CVE-2021-3409, bsc#1182282)
- Fix potential privilege escalation in virtiofsd tool (CVE-2021-20263, bsc#1183373)
- Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)
- Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)
- Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
- QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
- For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-3419, bsc#1182975)
Список пакетов
Container suse/sle-micro-rancher/5.2:latest
Container suse/sles/15.3/cdi-importer:1.37.1
Container suse/sles/15.3/cdi-uploadserver:1.37.1
Container suse/sles/15.3/libguestfs-tools:0.45.0
Container suse/sles/15.3/virt-handler:0.45.0
Container suse/sles/15.3/virt-launcher:0.45.0
Image SLES15-SP3-EC2-ECS-HVM
SUSE Linux Enterprise Module for Basesystem 15 SP3
SUSE Linux Enterprise Module for Server Applications 15 SP3
Ссылки
- Link for SUSE-SU-2021:1942-1
- E-Mail link for SUSE-SU-2021:1942-1
- SUSE Security Ratings
- SUSE Bug 1149813
- SUSE Bug 1163019
- SUSE Bug 1175144
- SUSE Bug 1175534
- SUSE Bug 1176681
- SUSE Bug 1178683
- SUSE Bug 1178935
- SUSE Bug 1179477
- SUSE Bug 1179484
- SUSE Bug 1179686
- SUSE Bug 1181103
- SUSE Bug 1182282
- SUSE Bug 1182425
- SUSE Bug 1182968
- SUSE Bug 1182975
- SUSE Bug 1183373
- SUSE Bug 1186290
Описание
libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.
Затронутые продукты
Ссылки
- CVE-2019-15890
- SUSE Bug 1149811
- SUSE Bug 1149813
- SUSE Bug 1178658
Описание
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.
Затронутые продукты
Ссылки
- CVE-2020-14364
- SUSE Bug 1175441
- SUSE Bug 1175534
- SUSE Bug 1176494
- SUSE Bug 1177130
Описание
A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support. It could occur while doing a multi block SDMA transfer via the sdhci_sdma_transfer_multi_blocks() routine in hw/sd/sdhci.c. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code with privileges of the QEMU process on the host.
Затронутые продукты
Ссылки
- CVE-2020-17380
- SUSE Bug 1175144
- SUSE Bug 1182282
Описание
QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.
Затронутые продукты
Ссылки
- CVE-2020-25085
- SUSE Bug 1176681
- SUSE Bug 1182282
Описание
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate is a duplicate of CVE-2020-28916
Затронутые продукты
Ссылки
- CVE-2020-25707
- SUSE Bug 1178683
- SUSE Bug 1179468
Описание
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.
Затронутые продукты
Ссылки
- CVE-2020-25723
- SUSE Bug 1178934
- SUSE Bug 1178935
Описание
A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service. This flaw affects QEMU versions prior to 5.2.0.
Затронутые продукты
Ссылки
- CVE-2020-27821
- SUSE Bug 1179686
Описание
ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
Затронутые продукты
Ссылки
- CVE-2020-29129
- SUSE Bug 1179466
- SUSE Bug 1179467
- SUSE Bug 1179477
- SUSE Bug 1179484
Описание
slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.
Затронутые продукты
Ссылки
- CVE-2020-29130
- SUSE Bug 1178658
- SUSE Bug 1179467
- SUSE Bug 1179477
Описание
In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.
Затронутые продукты
Ссылки
- CVE-2020-8608
- SUSE Bug 1163018
- SUSE Bug 1163019
Описание
A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.
Затронутые продукты
Ссылки
- CVE-2021-20263
- SUSE Bug 1183373
Описание
The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.
Затронутые продукты
Ссылки
- CVE-2021-3409
- SUSE Bug 1182282
Описание
A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.
Затронутые продукты
Ссылки
- CVE-2021-3416
- SUSE Bug 1182968
- SUSE Bug 1186473
Описание
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.
Затронутые продукты
Ссылки
- CVE-2021-3419
- SUSE Bug 1182968
- SUSE Bug 1182975