SB2024032251 - openEuler 22.03 LTS SP1 update for qemu

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2023-3019)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the e1000e_write_packet_to_guest() function in the e1000e NIC emulation code in QEMU. A local user can trigger DMA reentrancy and crash the QEMU process on the host.

2) NULL pointer dereference (CVE-ID: CVE-2023-6683)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when processing ClientCutText messages within the QEMU built-in VNC server. A remote authenticated VNC client can pass specially crafted data to the application and perform a denial of service (DoS) attack.

3) Stack-based buffer overflow (CVE-ID: CVE-2023-6693)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when flushing TX in the virtio_net_flush_tx() function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. A local user can trigger a stack based buffer overflow and execute arbitrary code on the system.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1312