Univention Bugzilla – Bug 53745
qemu: Multiple issues (4.4)
Last modified: 2021-09-08 16:54:01 CEST
New Debian qemu 1:2.8+dfsg-6+deb9u15A~4.4.8.202109060928 fixes: This update addresses the following issues: * usb: unbounded stack allocation in usbredir (CVE-2021-3527) * slirp: invalid pointer initialization may lead to information disclosure (bootp) (CVE-2021-3592) * slirp: invalid pointer initialization may lead to information disclosure (udp) (CVE-2021-3594) * slirp: invalid pointer initialization may lead to information disclosure (tftp) (CVE-2021-3595) * usbredir: free call on invalid pointer in bufp_alloc() (CVE-2021-3682) * out-of-bounds write in UAS (USB Attached SCSI) device emulation (CVE-2021-3713)
--- mirror/ftp/4.4/unmaintained/4.4-8/source/qemu_2.8+dfsg-6+deb9u14A~4.4.7.202104120844.dsc +++ apt/ucs_4.4-0-errata4.4-8/source/qemu_2.8+dfsg-6+deb9u15A~4.4.8.202109060928.dsc @@ -1,4 +1,4 @@ -1:2.8+dfsg-6+deb9u14A~4.4.7.202104120844 [Mon, 12 Apr 2021 08:49:29 +0200] Univention builddaemon <buildd@univention.de>: +1:2.8+dfsg-6+deb9u15A~4.4.8.202109060928 [Mon, 06 Sep 2021 09:35:39 +0200] Univention builddaemon <buildd@univention.de>: * UCS auto build. The following patches have been applied to the original source package 0001-Disable-Xen-for-UCS @@ -12,6 +12,54 @@ 1006-0007-Bug-38877-fix-qemu-kvm-1.1-piix4_pm-incompatibi 1007-0008-x86-Work-around-SMI-migration-breakages 1008-0009-migration-ram.c-do-not-set-postcopy_running-in-POSTC + +1:2.8+dfsg-6+deb9u15 [Wed, 01 Sep 2021 23:08:52 +0200] Markus Koschany <apo@debian.org>: + + * Non-maintainer upload by the ELTS team. + * Fix CVE-2021-3713: + An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device + emulation of QEMU. The device uses the guest supplied stream number + unchecked, which can lead to out-of-bounds access to the UASDevice->data3 + and UASDevice->status3 fields. A malicious guest user could use this flaw + to crash QEMU or potentially achieve code execution with the privileges of + the QEMU process on the host. + * Fix CVE-2021-3682: + A flaw was found in the USB redirector device emulation of QEMU. It occurs + when dropping packets during a bulk transfer from a SPICE client due to the + packet queue being full. A malicious SPICE client could use this flaw to + make QEMU call free() with faked heap chunk metadata, resulting in a crash + of QEMU or potential code execution with the privileges of the QEMU process + on the host. + * Fix CVE-2021-3527: + A flaw was found in the USB redirector device (usb-redir) of QEMU. Small + USB packets are combined into a single, large transfer request, to reduce + the overhead and improve performance. The combined size of the bulk + transfer is used to dynamically allocate a variable length array (VLA) on + the stack without proper validation. Since the total size is not bounded, a + malicious guest could use this flaw to influence the array length and cause + the QEMU process to perform an excessive allocation on the stack, resulting + in a denial of service. + * Fix CVE-2021-3594: + An invalid pointer initialization issue was found in the SLiRP networking + implementation of QEMU. The flaw exists in the udp_input() function and + could occur while processing a udp packet that is smaller than the size of + the 'udphdr' structure. This issue may lead to out-of-bounds read access or + indirect host memory disclosure to the guest. The highest threat from this + vulnerability is to data confidentiality. + * Fix CVE-2021-3592: + An invalid pointer initialization issue was found in the SLiRP networking + implementation of QEMU. The flaw exists in the bootp_input() function and + could occur while processing a udp packet that is smaller than the size of + the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 + bytes of uninitialized heap memory from the host. The highest threat from + this vulnerability is to data confidentiality. + * Fix CVE-2021-3595: + An invalid pointer initialization issue was found in the SLiRP networking + implementation of QEMU. The flaw exists in the tftp_input() function and + could occur while processing a udp packet that is smaller than the size of + the 'tftp_t' structure. This issue may lead to out-of-bounds read access or + indirect host memory disclosure to the guest. The highest threat from this + vulnerability is to data confidentiality. 1:2.8+dfsg-6+deb9u14 [Sat, 10 Apr 2021 16:38:50 +0200] Markus Koschany <apo@debian.org>: <http://piuparts.knut.univention.de/4.4-8/#1449785042819739352>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-8] 602ad9d4eb Bug #53745: qemu 1:2.8+dfsg-6+deb9u15A~4.4.8.202109060928 doc/errata/staging/qemu.yaml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
<https://errata.software-univention.de/#/?erratum=4.4x1044>