Debian update for qemu

1) Infinite loop

EUVDB-ID: #VU22783

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-12068

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in lsi_execute_script() when reading empty opcode. A local user can consume all available system resources and cause denial of service conditions.

Mitigation

Update qemu package to version 1:3.1+dfsg-8+deb10u5.

Vulnerable software versions

qemu (Debian package): 1:3.1+dfsg-8+deb10u2 - 3.1+dfsg-8+deb10u4

External links

http://www.debian.org/security/2020/dsa-4665

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU27386

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-15034

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the hw/display/bochs-display.c in QEMU due to application does not ensure a sufficient PCI config space allocation. A local user can trigger a buffer overflow and escalate privileges on the system.

Mitigation

Update qemu package to version 1:3.1+dfsg-8+deb10u5.

Vulnerable software versions

qemu (Debian package): 1:3.1+dfsg-8+deb10u2 - 3.1+dfsg-8+deb10u4

External links

http://www.debian.org/security/2020/dsa-4665

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Memory leak

EUVDB-ID: #VU27388

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-20382

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the zrle_compress_data() function in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd. A remote attacker can perform a denial of service attack.

Mitigation

Update qemu package to version 1:3.1+dfsg-8+deb10u5.

Vulnerable software versions

qemu (Debian package): 1:3.1+dfsg-8+deb10u2 - 3.1+dfsg-8+deb10u4

External links

http://www.debian.org/security/2020/dsa-4665

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

EUVDB-ID: #VU27389

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-1983

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error when processing packets within the ip_reass() function in ip_input.c in libslirp. A remote attacker can send a specially crafted packet to the application, trigger a use-after-free error and crash it.

Mitigation

Update qemu package to version 1:3.1+dfsg-8+deb10u5.

Vulnerable software versions

qemu (Debian package): 1:3.1+dfsg-8+deb10u2 - 3.1+dfsg-8+deb10u4

External links

http://www.debian.org/security/2020/dsa-4665

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.