An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
Seems like this is just an OOB access: https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg03581.html
Not sure if it's made it into version control/any release yet.
https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg03588.html suggests it's not in 6.1
Patch is in 6.2.0.
The bug has been referenced in the following commit(s):
Author: John Helmert III <firstname.lastname@example.org>
AuthorDate: 2021-12-19 17:16:07 +0000
Commit: Matthias Maier <email@example.com>
CommitDate: 2021-12-20 06:42:23 +0000
app-emulation/qemu: add 6.2.0
Signed-off-by: John Helmert III <firstname.lastname@example.org>
Signed-off-by: Matthias Maier <email@example.com>
app-emulation/qemu/Manifest | 1 +
app-emulation/qemu/qemu-6.2.0.ebuild | 916 +++++++++++++++++++++++++++++++++++
2 files changed, 917 insertions(+)
A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host when writing data reaches the threshold of mirroring node.
An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.
A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information.
A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.