SB2024122903 - SUSE update for qemu

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2023-1544)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the pvrdma_ring_next_elem_read() function in the QEMU implementation of VMWare's paravirtual RDMA device. A local user can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

2) Stack-based buffer overflow (CVE-ID: CVE-2023-6693)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when flushing TX in the virtio_net_flush_tx() function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. A local user can trigger a stack based buffer overflow and execute arbitrary code on the system.

3) Integer underflow (CVE-ID: CVE-2024-24474)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer underflow within the esp_do_nodma() function in hw/scsi/esp.c. A local user can pass specially crafted data to the application, trigger an integer underflow and perform a denial of service (DoS) attack.

4) Buffer overflow (CVE-ID: CVE-2024-26327)

The vulnerability allows a malicious guest to escalate privileges on the system.

The vulnerability exists due to a boundary error within the register_vfs() function in hw/pci/pcie_sriov.c in VF implementations. A malicious guest can trigger memory corruption and execute arbitrary code on the system.

5) Resource management error (CVE-ID: CVE-2024-26328)

The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application. The register_vfs() function in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF. A malicious guest can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2024/suse-su-20241103-1/