OESA-2021-1191

Dashboard / Vulnerabilities / OESA-2021-1191

OESA-2021-1191

Summary: qemu security update

Details: QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fix(es): A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.(CVE-2021-3416) The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.(CVE-2021-3409) A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.(CVE-2021-3392) QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.(CVE-2020-25085)

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1191, https://nvd.nist.gov/vuln/detail/CVE-2021-3416, https://nvd.nist.gov/vuln/detail/CVE-2021-3409, https://nvd.nist.gov/vuln/detail/CVE-2021-3392, https://nvd.nist.gov/vuln/detail/CVE-2020-25085