SB2024080937 - Gentoo update for QEMU
Published: August 9, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Infinite loop (CVE-ID: CVE-2020-14394)
The vulnerability allows an attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. A privileged user on the guest OS can consume all available system resources and cause denial of service conditions of the QEMU process on the host.
2) Use-after-free (CVE-ID: CVE-2022-0216)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU when processing repeated messages to cancel the current SCSI request via the lsi_do_msgout() function. A remote user on the guest OS can trigger a use-after-free error and perform a denial of service attack against the QEMU host.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
3) Use-after-free (CVE-ID: CVE-2022-1050)
The vulnerability allows a malicious guest to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the QEMU implementation of VMWare's paravirtual RDMA device. A specially crafted driver on a malicious guest can execute HW commands when shared buffers are not yet allocated, trigger a use-after-free error and execute arbitrary code on the QEMU host.
4) Out-of-bounds write (CVE-ID: CVE-2022-2962)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in the Tulip device emulation in QEMU. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges on the host OS.
5) Out-of-bounds read (CVE-ID: CVE-2022-4144)
The vulnerability allows a malicious guest user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition within the qxl_phys2virt() function in the QXL display device emulation in QEMU. A malicious guest user can trigger an out-of-bounds read error and crash the QEMU process on the host
6) Integer overflow (CVE-ID: CVE-2022-4172)
The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the read_erst_record() and write_erst_record() functions in the ACPI Error Record Serialization Table (ERST) device of QEMU. A malicious guest can overrun the host buffer allocated for the ERST memory device and crash the QEMU process on the host.
7) Out-of-bounds read (CVE-ID: CVE-2023-1544)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition within the pvrdma_ring_next_elem_read() function in the QEMU implementation of VMWare's paravirtual RDMA device. A local user can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.
8) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-2861)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to an error in the 9p passthrough filesystem (9pfs) implementation in QEMU. A local user can escape from the exported 9p tree by creating and opening a device file in the shared folder.
Remediation
Install update from vendor's website.