SUSE update for qemu



Published: 2023-04-27
Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2020-14394
CVE-2021-3507
CWE-ID CWE-835
CWE-122
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		SUSE Linux Enterprise Micro for Rancher
Operating systems & Components / Operating system

SUSE Linux Enterprise Micro
Operating systems & Components / Operating system

qemu-s390x
Operating systems & Components / Operating system package or component

qemu-s390x-debuginfo
Operating systems & Components / Operating system package or component

qemu-arm-debuginfo
Operating systems & Components / Operating system package or component

qemu-arm
Operating systems & Components / Operating system package or component

qemu-sgabios
Operating systems & Components / Operating system package or component

qemu-vgabios
Operating systems & Components / Operating system package or component

qemu-seabios
Operating systems & Components / Operating system package or component

qemu-ipxe
Operating systems & Components / Operating system package or component

qemu-accel-tcg-x86-debuginfo
Operating systems & Components / Operating system package or component

qemu-accel-tcg-x86
Operating systems & Components / Operating system package or component

qemu-x86-debuginfo
Operating systems & Components / Operating system package or component

qemu-x86
Operating systems & Components / Operating system package or component

qemu-ui-spice-core-debuginfo
Operating systems & Components / Operating system package or component

qemu-chardev-spice
Operating systems & Components / Operating system package or component

qemu-hw-display-virtio-vga
Operating systems & Components / Operating system package or component

qemu-hw-display-virtio-gpu
Operating systems & Components / Operating system package or component

qemu-audio-spice
Operating systems & Components / Operating system package or component

qemu-hw-display-qxl-debuginfo
Operating systems & Components / Operating system package or component

qemu-tools-debuginfo
Operating systems & Components / Operating system package or component

qemu-audio-spice-debuginfo
Operating systems & Components / Operating system package or component

qemu-debuginfo
Operating systems & Components / Operating system package or component

qemu
Operating systems & Components / Operating system package or component

qemu-guest-agent
Operating systems & Components / Operating system package or component

qemu-tools
Operating systems & Components / Operating system package or component

qemu-hw-display-qxl
Operating systems & Components / Operating system package or component

qemu-debugsource
Operating systems & Components / Operating system package or component

qemu-chardev-spice-debuginfo
Operating systems & Components / Operating system package or component

qemu-hw-display-virtio-gpu-debuginfo
Operating systems & Components / Operating system package or component

qemu-ui-spice-core
Operating systems & Components / Operating system package or component

qemu-ui-opengl
Operating systems & Components / Operating system package or component

qemu-guest-agent-debuginfo
Operating systems & Components / Operating system package or component

qemu-hw-usb-redirect-debuginfo
Operating systems & Components / Operating system package or component

qemu-hw-usb-redirect
Operating systems & Components / Operating system package or component

qemu-ui-opengl-debuginfo
Operating systems & Components / Operating system package or component

qemu-hw-display-virtio-vga-debuginfo
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Infinite loop

EUVDB-ID: #VU73788

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-14394

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. A privileged user on the guest OS can consume all available system resources and cause denial of service conditions of the QEMU process on the host.

Mitigation

Update the affected package qemu to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Micro for Rancher: 5.4

SUSE Linux Enterprise Micro: 5.4

qemu-s390x: before 6.2.0-150400.37.14.2

qemu-s390x-debuginfo: before 6.2.0-150400.37.14.2

qemu-arm-debuginfo: before 6.2.0-150400.37.14.2

qemu-arm: before 6.2.0-150400.37.14.2

qemu-sgabios: before 8-150400.37.14.2

qemu-vgabios: before 1.15.0_0_g2dd4b9b-150400.37.14.2

qemu-seabios: before 1.15.0_0_g2dd4b9b-150400.37.14.2

qemu-ipxe: before 1.0.0+-150400.37.14.2

qemu-accel-tcg-x86-debuginfo: before 6.2.0-150400.37.14.2

qemu-accel-tcg-x86: before 6.2.0-150400.37.14.2

qemu-x86-debuginfo: before 6.2.0-150400.37.14.2

qemu-x86: before 6.2.0-150400.37.14.2

qemu-ui-spice-core-debuginfo: before 6.2.0-150400.37.14.2

qemu-chardev-spice: before 6.2.0-150400.37.14.2

qemu-hw-display-virtio-vga: before 6.2.0-150400.37.14.2

qemu-hw-display-virtio-gpu: before 6.2.0-150400.37.14.2

qemu-audio-spice: before 6.2.0-150400.37.14.2

qemu-hw-display-qxl-debuginfo: before 6.2.0-150400.37.14.2

qemu-tools-debuginfo: before 6.2.0-150400.37.14.2

qemu-audio-spice-debuginfo: before 6.2.0-150400.37.14.2

qemu-debuginfo: before 6.2.0-150400.37.14.2

qemu: before 6.2.0-150400.37.14.2

qemu-guest-agent: before 6.2.0-150400.37.14.2

qemu-tools: before 6.2.0-150400.37.14.2

qemu-hw-display-qxl: before 6.2.0-150400.37.14.2

qemu-debugsource: before 6.2.0-150400.37.14.2

qemu-chardev-spice-debuginfo: before 6.2.0-150400.37.14.2

qemu-hw-display-virtio-gpu-debuginfo: before 6.2.0-150400.37.14.2

qemu-ui-spice-core: before 6.2.0-150400.37.14.2

qemu-ui-opengl: before 6.2.0-150400.37.14.2

qemu-guest-agent-debuginfo: before 6.2.0-150400.37.14.2

qemu-hw-usb-redirect-debuginfo: before 6.2.0-150400.37.14.2

qemu-hw-usb-redirect: before 6.2.0-150400.37.14.2

qemu-ui-opengl-debuginfo: before 6.2.0-150400.37.14.2

qemu-hw-display-virtio-vga-debuginfo: before 6.2.0-150400.37.14.2

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20230879-2/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Heap-based buffer overflow

EUVDB-ID: #VU64569

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3507

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the fdctrl_transfer_handler() function in hw/block/fdc.c while processing DMA read data transfers from the floppy drive to the guest system. A remote privileged user on the guest OS can trigger a heap-based buffer overflow and crash the QEMU process on the host OS.

Mitigation

Update the affected package qemu to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Micro for Rancher: 5.4

SUSE Linux Enterprise Micro: 5.4

qemu-s390x: before 6.2.0-150400.37.14.2

qemu-s390x-debuginfo: before 6.2.0-150400.37.14.2

qemu-arm-debuginfo: before 6.2.0-150400.37.14.2

qemu-arm: before 6.2.0-150400.37.14.2

qemu-sgabios: before 8-150400.37.14.2

qemu-vgabios: before 1.15.0_0_g2dd4b9b-150400.37.14.2

qemu-seabios: before 1.15.0_0_g2dd4b9b-150400.37.14.2

qemu-ipxe: before 1.0.0+-150400.37.14.2

qemu-accel-tcg-x86-debuginfo: before 6.2.0-150400.37.14.2

qemu-accel-tcg-x86: before 6.2.0-150400.37.14.2

qemu-x86-debuginfo: before 6.2.0-150400.37.14.2

qemu-x86: before 6.2.0-150400.37.14.2

qemu-ui-spice-core-debuginfo: before 6.2.0-150400.37.14.2

qemu-chardev-spice: before 6.2.0-150400.37.14.2

qemu-hw-display-virtio-vga: before 6.2.0-150400.37.14.2

qemu-hw-display-virtio-gpu: before 6.2.0-150400.37.14.2

qemu-audio-spice: before 6.2.0-150400.37.14.2

qemu-hw-display-qxl-debuginfo: before 6.2.0-150400.37.14.2

qemu-tools-debuginfo: before 6.2.0-150400.37.14.2

qemu-audio-spice-debuginfo: before 6.2.0-150400.37.14.2

qemu-debuginfo: before 6.2.0-150400.37.14.2

qemu: before 6.2.0-150400.37.14.2

qemu-guest-agent: before 6.2.0-150400.37.14.2

qemu-tools: before 6.2.0-150400.37.14.2

qemu-hw-display-qxl: before 6.2.0-150400.37.14.2

qemu-debugsource: before 6.2.0-150400.37.14.2

qemu-chardev-spice-debuginfo: before 6.2.0-150400.37.14.2

qemu-hw-display-virtio-gpu-debuginfo: before 6.2.0-150400.37.14.2

qemu-ui-spice-core: before 6.2.0-150400.37.14.2

qemu-ui-opengl: before 6.2.0-150400.37.14.2

qemu-guest-agent-debuginfo: before 6.2.0-150400.37.14.2

qemu-hw-usb-redirect-debuginfo: before 6.2.0-150400.37.14.2

qemu-hw-usb-redirect: before 6.2.0-150400.37.14.2

qemu-ui-opengl-debuginfo: before 6.2.0-150400.37.14.2

qemu-hw-display-virtio-vga-debuginfo: before 6.2.0-150400.37.14.2

External links

http://www.suse.com/support/update/announcement/2023/suse-su-20230879-2/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###