Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 810544 (CVE-2021-3713, CVE-2021-3748, CVE-2021-3930, CVE-2021-3947, CVE-2021-4145) - <app-emulation/qemu-6.2.0: multiple vulnerabilities
Summary: <app-emulation/qemu-6.2.0: multiple vulnerabilities
Status: CONFIRMED
Alias: CVE-2021-3713, CVE-2021-3748, CVE-2021-3930, CVE-2021-3947, CVE-2021-4145
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B4 [glsa?]
Keywords: PullRequest
Depends on: 830014
Blocks:
  Show dependency tree
 
Reported: 2021-08-26 21:28 UTC by John Helmert III
Modified: 2022-04-21 23:45 UTC (History)
5 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III gentoo-dev Security 2021-08-26 21:28:35 UTC
CVE-2021-3713:

An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.


Seems like this is just an OOB access: https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg03581.html
Patch: https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg02766.html

Not sure if it's made it into version control/any release yet.
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-08-26 21:31:34 UTC
https://lists.nongnu.org/archive/html/qemu-devel/2021-08/msg03588.html suggests it's not in 6.1
Comment 2 John Helmert III gentoo-dev Security 2021-12-19 17:35:50 UTC
Patch is in 6.2.0.
Comment 3 Larry the Git Cow gentoo-dev 2021-12-20 06:42:35 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=229a044368567d65aee9b3b4f3008f9526ddc196

commit 229a044368567d65aee9b3b4f3008f9526ddc196
Author:     John Helmert III <ajak@gentoo.org>
AuthorDate: 2021-12-19 17:16:07 +0000
Commit:     Matthias Maier <tamiko@gentoo.org>
CommitDate: 2021-12-20 06:42:23 +0000

    app-emulation/qemu: add 6.2.0
    
    Bug: https://bugs.gentoo.org/810544
    Signed-off-by: John Helmert III <ajak@gentoo.org>
    Signed-off-by: Matthias Maier <tamiko@gentoo.org>

 app-emulation/qemu/Manifest          |   1 +
 app-emulation/qemu/qemu-6.2.0.ebuild | 916 +++++++++++++++++++++++++++++++++++
 2 files changed, 917 insertions(+)
Comment 4 John Helmert III gentoo-dev Security 2022-01-29 18:30:44 UTC
CVE-2021-4145 (https://bugzilla.redhat.com/show_bug.cgi?id=2034602):

A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host when writing data reaches the threshold of mirroring node.

Patch: https://gitlab.com/qemu-project/qemu/-/commit/66fed30c9cd11854fc878a4eceb507e915d7c9cd
Comment 5 John Helmert III gentoo-dev Security 2022-02-18 22:42:37 UTC
CVE-2021-3930 (https://bugzilla.redhat.com/show_bug.cgi?id=2020588):

An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.

CVE-2021-3947 (https://bugzilla.redhat.com/show_bug.cgi?id=2021869):

A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information.
Comment 6 John Helmert III gentoo-dev Security 2022-03-24 20:05:21 UTC
CVE-2021-3748 (https://github.com/qemu/qemu/commit/bedd7e93d01961fcb16a97ae45d93acf357e11f6):

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.