Описание
Security update for qemu
This update for qemu fixes the following issues:
- CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
- CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
- CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
- CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
Список пакетов
Container suse/sle-micro-rancher/5.2:latest
Container suse/sles/15.3/cdi-importer:1.37.1
Container suse/sles/15.3/cdi-uploadserver:1.37.1
Container suse/sles/15.3/libguestfs-tools:0.45.0
Container suse/sles/15.3/virt-handler:0.45.0
Container suse/sles/15.3/virt-launcher:0.45.0
Image SLES15-SP3-EC2-ECS-HVM
SUSE Linux Enterprise Module for Basesystem 15 SP3
SUSE Linux Enterprise Module for Server Applications 15 SP3
Ссылки
- Link for SUSE-SU-2021:2442-1
- E-Mail link for SUSE-SU-2021:2442-1
- SUSE Security Ratings
- SUSE Bug 1187499
- SUSE Bug 1187529
- SUSE Bug 1187538
- SUSE Bug 1187539
- SUSE CVE CVE-2021-3582 page
- SUSE CVE CVE-2021-3607 page
- SUSE CVE CVE-2021-3608 page
- SUSE CVE CVE-2021-3611 page
Описание
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" command due to improper memory remapping (mremap). This flaw allows a malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to system availability.
Затронутые продукты
Ссылки
- CVE-2021-3582
- SUSE Bug 1187499
Описание
An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest due to improper input validation. This flaw allows a privileged guest user to make QEMU allocate a large amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Затронутые продукты
Ссылки
- CVE-2021-3607
- SUSE Bug 1187539
Описание
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest and may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest threat from this vulnerability is to system availability.
Затронутые продукты
Ссылки
- CVE-2021-3608
- SUSE Bug 1187538
Описание
A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.
Затронутые продукты
Ссылки
- CVE-2021-3611
- SUSE Bug 1187529
- SUSE Bug 1193914