Bug 810544 (CVE-2021-3713, CVE-2021-3748, CVE-2021-3930, CVE-2021-3947, CVE-2021-4145) – <app-emulation/qemu-6.2.0: multiple vulnerabilities

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description John Helmert III 2021-08-26 21:28:35 UTC]

CVE-2021-3713:

An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.


Seems like this is just an OOB access: https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg03581.html
Patch: https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg02766.html

Not sure if it's made it into version control/any release yet.

[Comment 1 Sam James 2021-08-26 21:31:34 UTC]

https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg03588.html suggests it's not in 6.1

[Comment 2 John Helmert III 2021-12-19 17:35:50 UTC]

Patch is in 6.2.0.

[Comment 3 Larry the Git Cow 2021-12-20 06:42:35 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=229a044368567d65aee9b3b4f3008f9526ddc196

commit 229a044368567d65aee9b3b4f3008f9526ddc196
Author:     John Helmert III <[e-mail]>
AuthorDate: 2021-12-19 17:16:07 +0000
Commit:     Matthias Maier <[e-mail]>
CommitDate: 2021-12-20 06:42:23 +0000

    app-emulation/qemu: add 6.2.0
    
    Bug: https://bugs.gentoo.org/810544
    Signed-off-by: John Helmert III <[e-mail]>
    Signed-off-by: Matthias Maier <[e-mail]>

 app-emulation/qemu/Manifest          |   1 +
 app-emulation/qemu/qemu-6.2.0.ebuild | 916 +++++++++++++++++++++++++++++++++++
 2 files changed, 917 insertions(+)

[Comment 4 John Helmert III 2022-01-29 18:30:44 UTC]

CVE-2021-4145 (https://bugzilla.redhat.com/show_bug.cgi?id=2034602):

A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host when writing data reaches the threshold of mirroring node.

Patch: https://gitlab.com/qemu-project/qemu/-/commit/66fed30c9cd11854fc878a4eceb507e915d7c9cd

[Comment 5 John Helmert III 2022-02-18 22:42:37 UTC]

CVE-2021-3930 (https://bugzilla.redhat.com/show_bug.cgi?id=2020588):

An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.

CVE-2021-3947 (https://bugzilla.redhat.com/show_bug.cgi?id=2021869):

A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information.

[Comment 6 John Helmert III 2022-03-24 20:05:21 UTC]

CVE-2021-3748 (https://github.com/qemu/qemu/commit/bedd7e93d01961fcb16a97ae45d93acf357e11f6):

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.

[Comment 7 John Helmert III 2022-08-14 04:42:27 UTC]

GLSA request filed

[Comment 8 Larry the Git Cow 2022-08-14 16:10:07 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=fd3b0a54cba850267bd5f7ed0ac9f66f91aa44ac

commit fd3b0a54cba850267bd5f7ed0ac9f66f91aa44ac
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-08-14 16:09:07 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-08-14 16:09:43 +0000

    [ GLSA 202208-27 ] QEMU: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/733448
    Bug: https://bugs.gentoo.org/736605
    Bug: https://bugs.gentoo.org/773220
    Bug: https://bugs.gentoo.org/775713
    Bug: https://bugs.gentoo.org/780816
    Bug: https://bugs.gentoo.org/792624
    Bug: https://bugs.gentoo.org/807055
    Bug: https://bugs.gentoo.org/810544
    Bug: https://bugs.gentoo.org/820743
    Bug: https://bugs.gentoo.org/835607
    Bug: https://bugs.gentoo.org/839762
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Sam James <[e-mail]>

 glsa-202208-27.xml | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)

[Comment 9 Sam James 2022-08-14 16:12:14 UTC]

GLSA done, all done.