Integer underflow in QEMU - CVE-2022-3165

Vulnerability identifier: #VU72307

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-3165

CWE-ID: CWE-191

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to integer underflow in the QEMU VNC server while processing ClientCutText messages in the extended format. A remote client can send a specially crafted payload message to the VNC server and perform a denial of service (DoS) attack.

QEMU
Oracle Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Linux Enterprise Micro for Rancher
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Ubuntu
Server Applications Module
Basesystem Module
openSUSE Leap
openEuler
Fedora
Red Hat OpenShift Container Platform
qemu-system-x86 (Ubuntu package)
qemu-system-aarch64 (Ubuntu package)
qemu (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-system-misc (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu-system (Ubuntu package)
qemu-system-mips (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-ipxe
qemu-vgabios
qemu-seabios
qemu-system-x86-microvm (Ubuntu package)
qemu-system-x86-xen (Ubuntu package)
qemu
qemu-system-aarch64
qemu-help
qemu-debuginfo
qemu-block-iscsi
qemu-debugsource
qemu-system-riscv
qemu-system-arm
qemu-img
qemu-system-x86_64
qemu-block-rbd
qemu-block-ssh
qemu-guest-agent
qemu-block-curl
qemu-hw-usb-host
qemu-chardev-baum
qemu-block-rbd-debuginfo
qemu-extra-debuginfo
qemu-hw-s390x-virtio-gpu-ccw-debuginfo
qemu-linux-user-debuginfo
qemu-hw-display-virtio-gpu-pci-debuginfo
qemu-block-dmg-debuginfo
qemu-audio-alsa-debuginfo
qemu-linux-user
qemu-skiboot
qemu-SLOF
qemu-microvm
qemu-kvm
qemu-audio-spice-debuginfo
qemu-s390x-debuginfo
qemu-tools-debuginfo
qemu-ui-spice-core-debuginfo
qemu-x86
qemu-accel-tcg-x86
qemu-accel-tcg-x86-debuginfo
qemu-x86-debuginfo
qemu-arm-debuginfo
qemu-arm
qemu-chardev-spice
qemu-block-nfs-debuginfo
qemu-lang
qemu-hw-usb-smartcard
qemu-accel-qtest
qemu-ivshmem-tools-debuginfo
qemu-linux-user-debugsource
qemu-audio-pa-debuginfo
qemu-hw-display-qxl-debuginfo
qemu-hw-display-qxl
qemu-tools
qemu-hw-usb-redirect
qemu-chardev-spice-debuginfo
qemu-ui-opengl
qemu-hw-display-virtio-gpu
qemu-hw-display-virtio-vga-debuginfo
qemu-hw-display-virtio-vga
qemu-block-curl-debuginfo
qemu-hw-display-virtio-gpu-debuginfo
qemu-ui-opengl-debuginfo
qemu-guest-agent-debuginfo
qemu-hw-usb-redirect-debuginfo
qemu-audio-spice
qemu-ui-spice-core
qemu-block-iscsi-debuginfo
qemu-hw-usb-host-debuginfo
qemu-block-gluster-debuginfo
qemu-hw-usb-smartcard-debuginfo
qemu-ivshmem-tools
qemu-ui-curses-debuginfo
qemu-vhost-user-gpu-debuginfo
qemu-s390x
qemu-ppc-debuginfo
qemu-ui-curses
qemu-ksm
qemu-ui-gtk
qemu-audio-jack
qemu-hw-display-virtio-gpu-pci
qemu-block-gluster
qemu-audio-alsa
qemu-extra
qemu-audio-jack-debuginfo
qemu-chardev-baum-debuginfo
qemu-block-nfs
qemu-audio-oss-debuginfo
qemu-ppc
qemu-audio-pa
qemu-block-ssh-debuginfo
qemu-ui-gtk-debuginfo
qemu-vhost-user-gpu
qemu-block-dmg
qemu-accel-qtest-debuginfo
qemu-ui-spice-app-debuginfo
qemu-hw-s390x-virtio-gpu-ccw
qemu-ui-spice-app
qemu-testsuite
qemu-kvm (Red Hat package)
qemu-sgabios
VMware Tanzu Operations Manager

Install updates from vendor's website.

Red Hat OpenShift Container Platform - update to 4.13.2
qemu-system-x86 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.24, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-system-aarch64 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
qemu (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.24, 1:6.2+dfsg-2ubuntu6.6
qemu-system-arm (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.24, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-system-misc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.24, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-system-s390x (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.24, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-system (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.24, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-system-mips (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.24, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-system-ppc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.24, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-system-sparc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1:2.11+dfsg-1ubuntu7.41, 1:4.2-3ubuntu6.24, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu-ipxe - update to 1.0.0+-150400.37.11.1
qemu-vgabios - update to 1.15.0_0_g2dd4b9b-150400.37.11.1
qemu-seabios - update to 1.15.0_0_g2dd4b9b-150400.37.11.1
VMware Tanzu Operations Manager - addressed in versions 2.10.51, 3.0.2
qemu-system-x86-microvm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.24, 1:6.2+dfsg-2ubuntu6.6
qemu-system-x86-xen (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.24, 1:6.2+dfsg-2ubuntu6.6, 1:7.0+dfsg-7ubuntu2.1
qemu - addressed in versions 6.2.0-16.fc36, 7.0.0-10.fc37
qemu-system-aarch64 - update to 6.2.0-53
qemu-seabios - update to 6.2.0-53
qemu-help - update to 6.2.0-53
qemu - update to 6.2.0-53
qemu-debuginfo - update to 6.2.0-53
qemu-block-iscsi - update to 6.2.0-53
qemu-debugsource - update to 6.2.0-53
qemu-system-riscv - update to 6.2.0-53
qemu-system-arm - update to 6.2.0-53
qemu-img - update to 6.2.0-53
qemu-system-x86_64 - update to 6.2.0-53
qemu-block-rbd - update to 6.2.0-53
qemu-block-ssh - update to 6.2.0-53
qemu-guest-agent - update to 6.2.0-53
qemu-block-curl - update to 6.2.0-53
qemu-hw-usb-host - update to 6.2.0-53
qemu-chardev-baum - update to 6.2.0-150400.37.11.1
qemu-block-rbd-debuginfo - update to 6.2.0-150400.37.11.1
qemu-extra-debuginfo - update to 6.2.0-150400.37.11.1
qemu-hw-s390x-virtio-gpu-ccw-debuginfo - update to 6.2.0-150400.37.11.1
qemu-linux-user-debuginfo - update to 6.2.0-150400.37.11.1
qemu-hw-display-virtio-gpu-pci-debuginfo - update to 6.2.0-150400.37.11.1
qemu-block-dmg-debuginfo - update to 6.2.0-150400.37.11.1
qemu-audio-alsa-debuginfo - update to 6.2.0-150400.37.11.1
qemu-linux-user - update to 6.2.0-150400.37.11.1
qemu-skiboot - update to 6.2.0-150400.37.11.1
qemu-SLOF - update to 6.2.0-150400.37.11.1
qemu-microvm - update to 6.2.0-150400.37.11.1
qemu-kvm - update to 6.2.0-150400.37.11.1
qemu-audio-spice-debuginfo - update to 6.2.0-150400.37.11.1
qemu-s390x-debuginfo - update to 6.2.0-150400.37.11.1
qemu-guest-agent - update to 6.2.0-150400.37.11.1
qemu-tools-debuginfo - update to 6.2.0-150400.37.11.1
qemu-ui-spice-core-debuginfo - update to 6.2.0-150400.37.11.1
qemu-x86 - update to 6.2.0-150400.37.11.1
qemu-accel-tcg-x86 - update to 6.2.0-150400.37.11.1
qemu-accel-tcg-x86-debuginfo - update to 6.2.0-150400.37.11.1
qemu-x86-debuginfo - update to 6.2.0-150400.37.11.1
qemu-arm-debuginfo - update to 6.2.0-150400.37.11.1
qemu-arm - update to 6.2.0-150400.37.11.1
qemu-chardev-spice - update to 6.2.0-150400.37.11.1
qemu-block-nfs-debuginfo - update to 6.2.0-150400.37.11.1
qemu-lang - update to 6.2.0-150400.37.11.1
qemu-block-iscsi - update to 6.2.0-150400.37.11.1
qemu-hw-usb-smartcard - update to 6.2.0-150400.37.11.1
qemu-accel-qtest - update to 6.2.0-150400.37.11.1
qemu-ivshmem-tools-debuginfo - update to 6.2.0-150400.37.11.1
qemu-linux-user-debugsource - update to 6.2.0-150400.37.11.1
qemu-audio-pa-debuginfo - update to 6.2.0-150400.37.11.1
qemu-hw-display-qxl-debuginfo - update to 6.2.0-150400.37.11.1
qemu-hw-display-qxl - update to 6.2.0-150400.37.11.1
qemu-tools - update to 6.2.0-150400.37.11.1
qemu-hw-usb-redirect - update to 6.2.0-150400.37.11.1
qemu-chardev-spice-debuginfo - update to 6.2.0-150400.37.11.1
qemu-debuginfo - update to 6.2.0-150400.37.11.1
qemu-ui-opengl - update to 6.2.0-150400.37.11.1
qemu-hw-display-virtio-gpu - update to 6.2.0-150400.37.11.1
qemu-hw-display-virtio-vga-debuginfo - update to 6.2.0-150400.37.11.1
qemu-hw-display-virtio-vga - update to 6.2.0-150400.37.11.1
qemu-block-curl-debuginfo - update to 6.2.0-150400.37.11.1
qemu-debugsource - update to 6.2.0-150400.37.11.1
qemu-hw-display-virtio-gpu-debuginfo - update to 6.2.0-150400.37.11.1
qemu-ui-opengl-debuginfo - update to 6.2.0-150400.37.11.1
qemu-guest-agent-debuginfo - update to 6.2.0-150400.37.11.1
qemu-hw-usb-redirect-debuginfo - update to 6.2.0-150400.37.11.1
qemu-audio-spice - update to 6.2.0-150400.37.11.1
qemu - update to 6.2.0-150400.37.11.1
qemu-ui-spice-core - update to 6.2.0-150400.37.11.1
qemu-block-iscsi-debuginfo - update to 6.2.0-150400.37.11.1
qemu-hw-usb-host-debuginfo - update to 6.2.0-150400.37.11.1
qemu-block-gluster-debuginfo - update to 6.2.0-150400.37.11.1
qemu-block-ssh - update to 6.2.0-150400.37.11.1
qemu-hw-usb-smartcard-debuginfo - update to 6.2.0-150400.37.11.1
qemu-ivshmem-tools - update to 6.2.0-150400.37.11.1
qemu-ui-curses-debuginfo - update to 6.2.0-150400.37.11.1
qemu-vhost-user-gpu-debuginfo - update to 6.2.0-150400.37.11.1
qemu-hw-usb-host - update to 6.2.0-150400.37.11.1
qemu-s390x - update to 6.2.0-150400.37.11.1
qemu-ppc-debuginfo - update to 6.2.0-150400.37.11.1
qemu-ui-curses - update to 6.2.0-150400.37.11.1
qemu-ksm - update to 6.2.0-150400.37.11.1
qemu-ui-gtk - update to 6.2.0-150400.37.11.1
qemu-audio-jack - update to 6.2.0-150400.37.11.1
qemu-block-rbd - update to 6.2.0-150400.37.11.1
qemu-hw-display-virtio-gpu-pci - update to 6.2.0-150400.37.11.1
qemu-block-gluster - update to 6.2.0-150400.37.11.1
qemu-audio-alsa - update to 6.2.0-150400.37.11.1
qemu-extra - update to 6.2.0-150400.37.11.1
qemu-audio-jack-debuginfo - update to 6.2.0-150400.37.11.1
qemu-chardev-baum-debuginfo - update to 6.2.0-150400.37.11.1
qemu-block-nfs - update to 6.2.0-150400.37.11.1
qemu-audio-oss-debuginfo - update to 6.2.0-150400.37.11.1
qemu-ppc - update to 6.2.0-150400.37.11.1
qemu-audio-pa - update to 6.2.0-150400.37.11.1
qemu-block-ssh-debuginfo - update to 6.2.0-150400.37.11.1
qemu-ui-gtk-debuginfo - update to 6.2.0-150400.37.11.1
qemu-vhost-user-gpu - update to 6.2.0-150400.37.11.1
qemu-block-dmg - update to 6.2.0-150400.37.11.1
qemu-accel-qtest-debuginfo - update to 6.2.0-150400.37.11.1
qemu-ui-spice-app-debuginfo - update to 6.2.0-150400.37.11.1
qemu-hw-s390x-virtio-gpu-ccw - update to 6.2.0-150400.37.11.1
qemu-ui-spice-app - update to 6.2.0-150400.37.11.1
qemu-block-curl - update to 6.2.0-150400.37.11.1
qemu-testsuite - update to 6.2.0-150400.37.11.2
qemu-kvm (Red Hat package) - update to 7.2.0-14.el9_2
qemu-sgabios - update to 8-150400.37.11.1

• https://gitlab.com/qemu-project/qemu/-/commit/d307040b18
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I36LKZA7Z65J3LJU2P37LVTWDFTXBMPU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTY7TVHX62OJWF6IOBCIGLR2N5K4QN3E/
• https://security.netapp.com/advisory/ntap-20221223-0006/

• Denial of service in QEMU VNC server
• SUSE update for qemu
• VMware Tanzu Operations Manager update for QEMU
• Red Hat Enterprise Linux 9 update for qemu-kvm
• Red Hat Enterprise Linux 8 update for the virt:rhel and virt-devel:rhel modules
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat OpenShift Container Platform release 4.13
• openEuler 22.03 LTS update for qemu
• Ubuntu update for qemu
• Fedora 36 update for qemu
• Fedora 37 update for qemu