CVE-2021-3713: An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host. Seems like this is just an OOB access: https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg03581.html Patch: https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg02766.html Not sure if it's made it into version control/any release yet.
https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg03588.html suggests it's not in 6.1
Patch is in 6.2.0.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=229a044368567d65aee9b3b4f3008f9526ddc196 commit 229a044368567d65aee9b3b4f3008f9526ddc196 Author: John Helmert III <ajak@gentoo.org> AuthorDate: 2021-12-19 17:16:07 +0000 Commit: Matthias Maier <tamiko@gentoo.org> CommitDate: 2021-12-20 06:42:23 +0000 app-emulation/qemu: add 6.2.0 Bug: https://bugs.gentoo.org/810544 Signed-off-by: John Helmert III <ajak@gentoo.org> Signed-off-by: Matthias Maier <tamiko@gentoo.org> app-emulation/qemu/Manifest | 1 + app-emulation/qemu/qemu-6.2.0.ebuild | 916 +++++++++++++++++++++++++++++++++++ 2 files changed, 917 insertions(+)
CVE-2021-4145 (https://bugzilla.redhat.com/show_bug.cgi?id=2034602): A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host when writing data reaches the threshold of mirroring node. Patch: https://gitlab.com/qemu-project/qemu/-/commit/66fed30c9cd11854fc878a4eceb507e915d7c9cd
CVE-2021-3930 (https://bugzilla.redhat.com/show_bug.cgi?id=2020588): An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition. CVE-2021-3947 (https://bugzilla.redhat.com/show_bug.cgi?id=2021869): A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information.
CVE-2021-3748 (https://github.com/qemu/qemu/commit/bedd7e93d01961fcb16a97ae45d93acf357e11f6): A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.
GLSA request filed
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=fd3b0a54cba850267bd5f7ed0ac9f66f91aa44ac commit fd3b0a54cba850267bd5f7ed0ac9f66f91aa44ac Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2022-08-14 16:09:07 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2022-08-14 16:09:43 +0000 [ GLSA 202208-27 ] QEMU: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/733448 Bug: https://bugs.gentoo.org/736605 Bug: https://bugs.gentoo.org/773220 Bug: https://bugs.gentoo.org/775713 Bug: https://bugs.gentoo.org/780816 Bug: https://bugs.gentoo.org/792624 Bug: https://bugs.gentoo.org/807055 Bug: https://bugs.gentoo.org/810544 Bug: https://bugs.gentoo.org/820743 Bug: https://bugs.gentoo.org/835607 Bug: https://bugs.gentoo.org/839762 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: Sam James <sam@gentoo.org> glsa-202208-27.xml | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 85 insertions(+)
GLSA done, all done.
