Several vulnerabilities were discovered in QEMU, a fast processor emulator (notably used in KVM and Xen HVM virtualization). An attacker could trigger a denial of service (DoS), information leak, and possibly execute arbitrary code with the privileges of the QEMU process on the host.

CVE-2020-15469

A MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.

CVE-2020-15859

QEMU has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.

CVE-2020-25084

QEMU has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.

CVE-2020-28916

hw/net/e1000e_core.c has an infinite loop via an RX descriptor with a NULL buffer address.

CVE-2020-29130

slirp.c has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

CVE-2020-29443

ide_atapi_cmd_reply_end in hw/ide/atapi.c allows out-of-bounds read access because a buffer index is not validated.

CVE-2021-20181

9pfs: ZDI-CAN-10904: QEMU Plan 9 file system TOCTOU privilege escalation vulnerability.

CVE-2021-20221

aarch64: GIC: out-of-bound heap buffer access via an interrupt ID field.

For Debian 9 stretch, these problems have been fixed in version 1:2.8+dfsg-6+deb9u13.

We recommend that you upgrade your qemu packages.

For the detailed security status of qemu please refer to its security tracker page at: https://security-tracker.debian.org/tracker/qemu

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5010-1 advisory.

    Lei Sun discovered that QEMU incorrectly handled certain MMIO operations. An attacker inside the guest     could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-15469)

    Wenxiang Qian discovered that QEMU incorrectly handled certain ATAPI commands. An attacker inside the     guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue     only affected Ubuntu 21.04. (CVE-2020-29443)

    Cheolwoo Myung discovered that QEMU incorrectly handled SCSI device emulation. An attacker inside the     guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service.
    (CVE-2020-35504, CVE-2020-35505, CVE-2021-3392)

    Alex Xu discovered that QEMU incorrectly handled the virtio-fs shared file system daemon. An attacker     inside the guest could possibly use this issue to read and write to host devices. This issue only affected     Ubuntu 20.10. (CVE-2020-35517)

    It was discovered that QEMU incorrectly handled ARM Generic Interrupt Controller emulation. An attacker     inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service.
    This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-20221)

    Alexander Bulekov, Cheolwoo Myung, Sergej Schumilo, Cornelius Aschermann, and Simon Werner discovered that     QEMU incorrectly handled e1000 device emulation. An attacker inside the guest could possibly use this     issue to cause QEMU to hang, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS,     Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-20257)

    It was discovered that QEMU incorrectly handled SDHCI controller emulation. An attacker inside the guest     could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute     arbitrary code. In the default installation, when QEMU is used in combination with libvirt, attackers     would be isolated by the libvirt AppArmor profile. (CVE-2021-3409)

    It was discovered that QEMU incorrectly handled certain NIC emulation devices. An attacker inside the     guest could possibly use this issue to cause QEMU to hang or crash, resulting in a denial of service. This     issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-3416)

    Remy Noel discovered that QEMU incorrectly handled the USB redirector device. An attacker inside the guest     could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service.
    (CVE-2021-3527)

    It was discovered that QEMU incorrectly handled the virtio vhost-user GPU device. An attacker inside the     guest could possibly use this issue to cause QEMU to consume resources, leading to a denial of service.
    This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3544)

    It was discovered that QEMU incorrectly handled the virtio vhost-user GPU device. An attacker inside the     guest could possibly use this issue to obtain sensitive host information. This issue only affected Ubuntu     20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3545)

    It was discovered that QEMU incorrectly handled the virtio vhost-user GPU device. An attacker inside the     guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute     arbitrary code. In the default installation, when QEMU is used in combination with libvirt, attackers     would be isolated by the libvirt AppArmor profile. This issue only affected Ubuntu 20.04 LTS, Ubuntu     20.10, and Ubuntu 21.04. (CVE-2021-3546)

    It was discovered that QEMU incorrectly handled the PVRDMA device. An attacker inside the guest could use     this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code.
    In the default installation, when QEMU is used in combination with libvirt, attackers would be isolated by     the libvirt AppArmor profile. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04.
    (CVE-2021-3582, CVE-2021-3607, CVE-2021-3608)

    It was discovered that QEMU SLiRP networking incorrectly handled certain udp packets. An attacker inside a     guest could possibly use this issue to leak sensitive information from the host. (CVE-2021-3592,     CVE-2021-3593, CVE-2021-3594, CVE-2021-3595)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - QEMU: usbredir: free() call on invalid pointer in bufp_alloc() (CVE-2021-3682)

  - qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from     bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
    (CVE-2019-13164)

  - In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer     dereference. (CVE-2020-15469)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for qemu fixes the following issues :

Fix OOB access in sm501 device emulation (CVE-2020-12829, bsc#1172385)

Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)

Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)

Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)

Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)

Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)

Fix guest triggerable assert in shared network handling code (CVE-2020-27617, bsc#1178174)

Fix infinite loop (DoS) in e1000e device emulation (CVE-2020-28916, bsc#1179468)

Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)

Fix NULL pointer deref. (DoS) in mmio ops (CVE-2020-15469, bsc#1173612)

Fix infinite loop (DoS) in e1000 device emulation (CVE-2021-20257, bsc#1182577)

Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)

Fix OOB access (stack overflow) in other NIC emulations (CVE-2021-3416)

Fix OOB access in SLIRP ARP/NCSI packet processing (CVE-2020-29129, bsc#1179466, CVE-2020-29130, bsc#1179467)

Fix NULL pointer dereference possibility (DoS) in MegaRAID SAS 8708EM2 emulation (CVE-2020-13659 bsc#1172386

Fix OOB access in iscsi (CVE-2020-11947 bsc#1180523)

Fix OOB access in vmxnet3 emulation (CVE-2021-20203 bsc#1181639)

Fix buffer overflow in the XGMAC device (CVE-2020-15863 bsc#1174386)

Fix DoS in packet processing of various emulated NICs (CVE-2020-16092 bsc#1174641)

Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441)

Fix package scripts to not use hard-coded paths for temporary working directories and log files (bsc#1182425)

Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)

Drop the 'ampersand 0x25 shift altgr' line in pt-br keymap file (bsc#1129962)

Fix migration failure with error message: 'error while loading state section id 3(ram) (bsc#1154790)

Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384)

Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)

Fix OOB access in ARM interrupt handling (CVE-2021-20221 bsc#1181933)

Tweaks to spec file for better formatting, and remove not needed BuildRequires for e2fsprogs-devel and libpcap-devel

Use '%service_del_postun_without_restart' instead of '%service_del_postun' to avoid 'Failed to try-restart qemu-ga@.service' error while updating the qemu-guest-agent.
(bsc#1178565)

Fix OOB access in sm501 device emulation (CVE-2020-12829, bsc#1172385)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
146609	Debian DLA-2560-1 : qemu security update	Nessus	Debian Local Security Checks	2021/2/19	2024/1/22	high
151680	Ubuntu 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-5010-1)	Nessus	Ubuntu Local Security Checks	2021/7/16	2024/8/27	high
202320	RHEL 8 : qemu-kvm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/7/12	2024/7/12	high
148757	SUSE SLES15 Security Update : qemu (SUSE-SU-2021:1244-1)	Nessus	SuSE Local Security Checks	2021/4/19	2024/1/3	high

偵測

搜尋 Plugin

high

high

high

high