SB2021100524 - Debian update for qemu
Published: October 5, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 secuirty vulnerabilities.
1) Memory leak (CVE-ID: CVE-2021-3544)
The vulnerability allows a remote user to perform DoS attack on the target system.
The vulnerability exists due to multiple memory leaks in the vhost-user-gpu/vhost-user-gpu.c. A remote authenticated user of the guest operating system can force the application to leak memory and perform denial of service attack.
2) Information disclosure (CVE-ID: CVE-2021-3545)
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to uninitialized memory disclosure within the virgl_cmd_get_capset_info() function in vhost-user-gpu/virgl.c. A remote authenticated user of the guest operating system can gain unauthorized access to sensitive information on the system.
3) Out-of-bounds write (CVE-ID: CVE-2021-3546)
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to a boundary error when processing untrusted input within the virgl_cmd_get_capset() function in vhost-user-gpu/virgl.c. A remote authenticated user of the guest operating system can trigger an out-of-bounds write and escalate privileges.
4) Out-of-bounds write (CVE-ID: CVE-2021-3638)
The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in the ATI VGA device emulation of QEMU within the ati_2d_blt() routine while handling MMIO write operations. A malicious guest can crash the QEMU process on the host.
5) Release of invalid pointer or reference (CVE-ID: CVE-2021-3682)
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists in the USB redirector device emulation of QEMU when dropping packets during a bulk transfer from a SPICE client. A remote user can make QEMU call free() with faked heap chunk metadata to perform a denial of service or escalate privileges on the system.
6) Out-of-bounds write (CVE-ID: CVE-2021-3713)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in the UAS (USB Attached SCSI) device emulation of QEMU. A local user can perform a denial of service or escalate privileges on the system.
7) Use-after-free (CVE-ID: CVE-2021-3748)
The vulnerability allows a remote guest to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when in the virtio-net device of QEMU. A malicious guest can trigger the use-after-free error and execute arbitrary code on the host system with QEMU privileges.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Remediation
Install update from vendor's website.