openEuler 22.03 LTS update for qemu
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) NULL pointer dereference
EUVDB-ID: #VU63781
Risk: Low
CVSSv3.1: 5.2 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-4158
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the ACPI code of QEMU when handling certain values. A privileged user can crash the QEMU process on the host, resulting in a denial of service condition.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
qemu-seabios: before 6.2.0-43
qemu-help: before 6.2.0-43
qemu-system-riscv: before 6.2.0-43
qemu-debuginfo: before 6.2.0-43
qemu-hw-usb-host: before 6.2.0-43
qemu-guest-agent: before 6.2.0-43
qemu-system-arm: before 6.2.0-43
qemu-debugsource: before 6.2.0-43
qemu-block-ssh: before 6.2.0-43
qemu-system-x86_64: before 6.2.0-43
qemu-img: before 6.2.0-43
qemu-system-aarch64: before 6.2.0-43
qemu-block-rbd: before 6.2.0-43
qemu-block-curl: before 6.2.0-43
qemu-block-iscsi: before 6.2.0-43
qemu: before 6.2.0-43
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1772
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Incorrect default permissions
EUVDB-ID: #VU61492
Risk: Low
CVSSv3.1: 6.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-0358
CWE-ID:
CWE-276 - Incorrect Default Permissions
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incorrect QEMU virtio-fs shared file system daemon (virtiofsd) implementation. An attacker on the guest OS can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This can lead to privilege escalation within the guest OS.
The vulnerability exists due to incomplete fox for #VU13631 (CVE-2018-13405).
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
qemu-seabios: before 6.2.0-43
qemu-help: before 6.2.0-43
qemu-system-riscv: before 6.2.0-43
qemu-debuginfo: before 6.2.0-43
qemu-hw-usb-host: before 6.2.0-43
qemu-guest-agent: before 6.2.0-43
qemu-system-arm: before 6.2.0-43
qemu-debugsource: before 6.2.0-43
qemu-block-ssh: before 6.2.0-43
qemu-system-x86_64: before 6.2.0-43
qemu-img: before 6.2.0-43
qemu-system-aarch64: before 6.2.0-43
qemu-block-rbd: before 6.2.0-43
qemu-block-curl: before 6.2.0-43
qemu-block-iscsi: before 6.2.0-43
qemu: before 6.2.0-43
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1772
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Security restrictions bypass
EUVDB-ID: #VU13631
Risk: Low
CVSSv3.1: 4.5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-13405
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to create arbitrary files on the target system.
The vulnerability exists due to the inode_init_owner function, as defined in the fs/inode.c source code file, allows the creation of arbitrary files in set-group identification (SGID) directories. A local attacker can create arbitrary files with unintended group ownership.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 22.03 LTS
qemu-seabios: before 6.2.0-43
qemu-help: before 6.2.0-43
qemu-system-riscv: before 6.2.0-43
qemu-debuginfo: before 6.2.0-43
qemu-hw-usb-host: before 6.2.0-43
qemu-guest-agent: before 6.2.0-43
qemu-system-arm: before 6.2.0-43
qemu-debugsource: before 6.2.0-43
qemu-block-ssh: before 6.2.0-43
qemu-system-x86_64: before 6.2.0-43
qemu-img: before 6.2.0-43
qemu-system-aarch64: before 6.2.0-43
qemu-block-rbd: before 6.2.0-43
qemu-block-curl: before 6.2.0-43
qemu-block-iscsi: before 6.2.0-43
qemu: before 6.2.0-43
External linkshttp://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2022-1772
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
