SB2024060637 - Ubuntu update for qemu
Published: June 6, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 14 secuirty vulnerabilities.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-2861)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to an error in the 9p passthrough filesystem (9pfs) implementation in QEMU. A local user can escape from the exported 9p tree by creating and opening a device file in the shared folder.
2) Infinite loop (CVE-ID: CVE-2020-14394)
The vulnerability allows an attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. A privileged user on the guest OS can consume all available system resources and cause denial of service conditions of the QEMU process on the host.
3) Input validation error (CVE-ID: CVE-2020-24165)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insufficient validation of user-supplied input in TCG Accelerator. A local user can escalate privileges on the system.
4) Out-of-bounds write (CVE-ID: CVE-2021-3611)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in the Intel HD Audio device (intel-hda) of QEMU. A remote user of the guest OS trigger an out-of-bounds write and crash the QEMU process on the host.
5) Out-of-bounds write (CVE-ID: CVE-2021-3638)
The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in the ATI VGA device emulation of QEMU within the ati_2d_blt() routine while handling MMIO write operations. A malicious guest can crash the QEMU process on the host.
6) Out-of-bounds read (CVE-ID: CVE-2023-1544)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition within the pvrdma_ring_next_elem_read() function in the QEMU implementation of VMWare's paravirtual RDMA device. A local user can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.
7) Out-of-bounds write (CVE-ID: CVE-2023-3180)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the virtio_crypto_handle_sym_req() function in hw/virtio/virtio-crypto.c of the QEMU virtual crypto device when handling data encryption/decryption requests. A local user trigger an out-of-bounds write and perform a denial of service 9DoS) attack.
8) Infinite loop (CVE-ID: CVE-2023-3255)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop within the vnc_client_cut_text_ext function in ui/vnc-clipboard.c. A remote authenticated client who is able to send a clipboard to the QEMU built-in VNC server can perform a denial of service conditions.
9) Reachable Assertion (CVE-ID: CVE-2023-3301)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion. When a peer nic is still attached to the vdpa backend, it is too early to free up the vhost-net and vdpa structures. If these structures are freed here, then QEMU crashes when the guest is being shut down.
10) NULL pointer dereference (CVE-ID: CVE-2023-3354)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the connection again, resulting in NULL pointer dereference and denial of service.
11) NULL pointer dereference (CVE-ID: CVE-2023-40360)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the nvme_directive_receive() function in hw/nvme/ctrl.c. A local user can pass specially crafted data to the application and perform a denial of service (DoS) attack.
12) Out-of-bounds read (CVE-ID: CVE-2023-4135)
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the NVMe virtual device. A remote administrator can trigger an out-of-bounds read error and read contents of memory on the system.
13) Division by zero (CVE-ID: CVE-2023-42467)
The vulnerability allows a local user to perform a denial of service attack.
The vulnerability exists due to a division by zero error within the scsi_disk_reset() function in hw/scsi/scsi-disk.c. A local user can pass specially crafted data to the application and crash it.
14) Improper synchronization (CVE-ID: CVE-2023-5088)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper synchronization, which causes guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead. An L2 guest with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor can read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.
Remediation
Install update from vendor's website.