Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:0210-2

Опубликовано: 18 фев. 2022
Источник: suse-cvrf

Описание

Security update for qemu

This update for qemu fixes the following issues:

  • CVE-2020-13253: Fixed an OOB access that could crash the guest resulting in DoS (bsc#1172033)
  • CVE-2021-20196: Fixed null pointer dereference that may lead to guest crash (bsc#1181361).

Список пакетов

SUSE Linux Enterprise Real Time 15 SP2
qemu-4.2.1-11.34.2
qemu-audio-alsa-4.2.1-11.34.2
qemu-audio-pa-4.2.1-11.34.2
qemu-block-curl-4.2.1-11.34.2
qemu-block-iscsi-4.2.1-11.34.2
qemu-block-rbd-4.2.1-11.34.2
qemu-block-ssh-4.2.1-11.34.2
qemu-guest-agent-4.2.1-11.34.2
qemu-ipxe-1.0.0+-11.34.2
qemu-kvm-4.2.1-11.34.2
qemu-lang-4.2.1-11.34.2
qemu-microvm-4.2.1-11.34.2
qemu-seabios-1.12.1+-11.34.2
qemu-sgabios-8-11.34.2
qemu-tools-4.2.1-11.34.2
qemu-ui-curses-4.2.1-11.34.2
qemu-ui-gtk-4.2.1-11.34.2
qemu-ui-spice-app-4.2.1-11.34.2
qemu-vgabios-1.12.1+-11.34.2
qemu-x86-4.2.1-11.34.2

Ссылки

Описание

sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.

Затронутые продукты
SUSE Linux Enterprise Real Time 15 SP2:qemu-4.2.1-11.34.2
SUSE Linux Enterprise Real Time 15 SP2:qemu-audio-alsa-4.2.1-11.34.2
SUSE Linux Enterprise Real Time 15 SP2:qemu-audio-pa-4.2.1-11.34.2
SUSE Linux Enterprise Real Time 15 SP2:qemu-block-curl-4.2.1-11.34.2
Ссылки

Описание

A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Затронутые продукты
SUSE Linux Enterprise Real Time 15 SP2:qemu-4.2.1-11.34.2
SUSE Linux Enterprise Real Time 15 SP2:qemu-audio-alsa-4.2.1-11.34.2
SUSE Linux Enterprise Real Time 15 SP2:qemu-audio-pa-4.2.1-11.34.2
SUSE Linux Enterprise Real Time 15 SP2:qemu-block-curl-4.2.1-11.34.2
Ссылки
Уязвимость SUSE-SU-2022:0210-2