Bug 792624 (CVE-2020-35504, CVE-2020-35505, CVE-2020-35506)

Summary:	<app-emulation/qemu-6.0.0: Multiple vulnerabilities (CVE-2020-{35504,35505,35506})
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	ajak, jaak, sam, tamiko, virtualization, zlogene
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B2 [glsa+ cve]
Package list:	app-emulation/qemu-6.0.0	Runtime testing required:	---
Bug Depends on:
Bug Blocks:	775713, 780816

Description Sam James archtester

2021-05-28 12:21:49 UTC

* CVE-2020-35506

Description:
"A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process."

* CVE-2020-35505

Description:
"A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability."

* CVE-2020-35504

Description:
"A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability."

Comment 1 Sam James archtester

2021-05-28 12:22:09 UTC

Please stable 6.0.0 when ready.

Comment 2 Agostino Sarubbo gentoo-dev

2021-06-06 07:15:02 UTC

amd64 stable

Comment 3 Sam James archtester

2021-06-06 22:10:04 UTC

arm64 done

Comment 4 Sergei Trofimovich (RETIRED) gentoo-dev

2021-06-07 07:19:32 UTC

ppc64 stable

Comment 5 Agostino Sarubbo gentoo-dev

2021-06-08 12:09:43 UTC

x86 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.

Comment 6 NATTkA bot gentoo-dev

2021-07-17 21:32:23 UTC

Unable to check for sanity:

> no match for package: app-emulation/qemu-6.0.0

Comment 7 John Helmert III archtester

2022-08-14 04:42:26 UTC

GLSA request filed

Comment 8 Larry the Git Cow gentoo-dev

2022-08-14 16:09:55 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=fd3b0a54cba850267bd5f7ed0ac9f66f91aa44ac

commit fd3b0a54cba850267bd5f7ed0ac9f66f91aa44ac
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-08-14 16:09:07 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-08-14 16:09:43 +0000

    [ GLSA 202208-27 ] QEMU: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/733448
    Bug: https://bugs.gentoo.org/736605
    Bug: https://bugs.gentoo.org/773220
    Bug: https://bugs.gentoo.org/775713
    Bug: https://bugs.gentoo.org/780816
    Bug: https://bugs.gentoo.org/792624
    Bug: https://bugs.gentoo.org/807055
    Bug: https://bugs.gentoo.org/810544
    Bug: https://bugs.gentoo.org/820743
    Bug: https://bugs.gentoo.org/835607
    Bug: https://bugs.gentoo.org/839762
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202208-27.xml | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)

Comment 9 Sam James archtester

2022-08-14 16:11:55 UTC

GLSA done, all done.