hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9034 advisory.

    - Document CVE-2020-25723 as fixed (Mark Kanda)  [Orabug: 32222397]  {CVE-2020-25084} {CVE-2020-25723}
    - hw/net/e1000e: advance desc_offset in case of null descriptor (Prasad J Pandit)  [Orabug: 32217517]     {CVE-2020-28916}
    - libslirp: Update version to include CVE fixes (Mark Kanda)  [Orabug: 32208456] [Orabug: 32208462]     {CVE-2020-29129} {CVE-2020-29130}
    - Document CVE-2020-25624 as fixed (Mark Kanda)  [Orabug: 32212527]  {CVE-2020-25624} {CVE-2020-25625}
    - ati: check x y display parameter values (Prasad J Pandit)  [Orabug: 32108251]  {CVE-2020-27616}
    - hw: usb: hcd-ohci: check for processed TD before retire (Prasad J Pandit)  [Orabug: 31901690]     {CVE-2020-25625}
    - hw: usb: hcd-ohci: check len and frame_number variables (Prasad J Pandit)  [Orabug: 31901690]     {CVE-2020-25625}
    - hw: ehci: check return value of 'usb_packet_map' (Li Qiang)  [Orabug: 31901649]  {CVE-2020-25084}
    - hw: xhci: check return value of 'usb_packet_map' (Li Qiang)  [Orabug: 31901649]  {CVE-2020-25084}
    - usb: fix setup_len init (CVE-2020-14364) (Gerd Hoffmann)  [Orabug: 31848849]  {CVE-2020-14364}
    - Document CVE-2020-12829 and CVE-2020-14415 as fixed (Mark Kanda)  [Orabug: 31855502] [Orabug: 31855427]     {CVE-2020-12829} {CVE-2020-14415}
    - hw/net/xgmac: Fix buffer overflow in xgmac_enet_send() (Mauro Matteo Cascella)  [Orabug: 31667649]     {CVE-2020-15863}
    - hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment() (Mauro Matteo Cascella)     [Orabug: 31737809]  {CVE-2020-16092}
    - hw/sd/sdcard: Do not switch to ReceivingData if address is invalid (Philippe Mathieu-Daude)  [Orabug:
    31414336]  {CVE-2020-13253}
    - hw/sd/sdcard: Do not allow invalid SD card sizes (Philippe Mathieu-Daude)  [Orabug: 31414336]     {CVE-2020-13253}
    - libslirp: Update to v4.3.1 to fix CVE-2020-10756 (Karl Heubaum)  [Orabug: 31604999]  {CVE-2020-10756}
    - Document CVEs as fixed 2/2 (Karl Heubaum)  [Orabug: 30618035]  {CVE-2017-18043} {CVE-2018-10839}     {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-15746} {CVE-2018-16847} {CVE-2018-16867} {CVE-2018-17958}     {CVE-2018-17962} {CVE-2018-17963} {CVE-2018-18849} {CVE-2018-19364} {CVE-2018-19489} {CVE-2018-3639}     {CVE-2018-5683} {CVE-2018-7550} {CVE-2018-7858} {CVE-2019-12068} {CVE-2019-15034} {CVE-2019-15890}     {CVE-2019-20382} {CVE-2020-10702} {CVE-2020-10761} {CVE-2020-11102} {CVE-2020-11869} {CVE-2020-13361}     {CVE-2020-13765} {CVE-2020-13800} {CVE-2020-1711} {CVE-2020-1983} {CVE-2020-8608}
    - Document CVEs as fixed 1/2 (Karl Heubaum)  [Orabug: 30618035]  {CVE-2017-10806} {CVE-2017-11334}     {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038}     {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381}     {CVE-2017-18030} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753} {CVE-2017-5754}     {CVE-2017-5931} {CVE-2017-6058} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309}     {CVE-2017-8379} {CVE-2017-8380} {CVE-2017-9503} {CVE-2017-9524} {CVE-2018-12126} {CVE-2018-12127}     {CVE-2018-12130} {CVE-2018-16872} {CVE-2018-20123} {CVE-2018-20124} {CVE-2018-20125} {CVE-2018-20126}     {CVE-2018-20191} {CVE-2018-20216} {CVE-2018-20815} {CVE-2019-11091} {CVE-2019-12155} {CVE-2019-14378}     {CVE-2019-3812} {CVE-2019-5008} {CVE-2019-6501} {CVE-2019-6778} {CVE-2019-8934} {CVE-2019-9824}
    - exec: set map length to zero when returning NULL (Prasad J Pandit)  [Orabug: 31439733]  {CVE-2020-13659}
    - megasas: use unsigned type for reply_queue_head and check index (Prasad J Pandit)  [Orabug: 31414338]     {CVE-2020-13362}
    - memory: Revert 'memory: accept mismatching sizes in memory_region_access_valid' (Michael S. Tsirkin)     [Orabug: 31439736] [Orabug: 31452202]  {CVE-2020-13754} {CVE-2020-13791}
    - Document CVE-2020-13765 as fixed (Karl Heubaum)  [Orabug: 31463250]  {CVE-2020-13765}
    - ati-vga: check mm_index before recursive call (CVE-2020-13800) (Prasad J Pandit)  [Orabug: 31452206]     {CVE-2020-13800}
    - es1370: check total frame count against current frame (Prasad J Pandit)  [Orabug: 31463235]     {CVE-2020-13361}
    - ati-vga: Fix checks in ati_2d_blt() to avoid crash (BALATON Zoltan)  [Orabug: 31238432]     {CVE-2020-11869}
    - libslirp: Update to stable-4.2 to fix CVE-2020-1983 (Karl Heubaum)  [Orabug: 31241227]  {CVE-2020-1983}
    - Document CVEs as fixed (Karl Heubaum)   {CVE-2019-12068} {CVE-2019-15034}
    - libslirp: Update to version 4.2.0 to fix CVEs (Karl Heubaum)  [Orabug: 30274592] [Orabug: 30869830]     {CVE-2019-15890} {CVE-2020-8608}
    - vnc: fix memory leak when vnc disconnect (Li Qiang)  [Orabug: 30996427]  {CVE-2019-20382}
    - iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711) (Felipe Franciosi)  [Orabug: 31124035]     {CVE-2020-1711}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4372-1 advisory.

    It was discovered that QEMU incorrectly handled bochs-display devices. A local attacker in a guest could     use this to cause a denial of service or possibly execute arbitrary code in the host. This issue only     affected Ubuntu 19.10. (CVE-2019-15034)

    It was discovered that QEMU incorrectly handled memory during certain VNC operations. A remote attacker     could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. This     issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10. (CVE-2019-20382)

    It was discovered that QEMU incorrectly generated QEMU Pointer Authentication signatures on ARM. A local     attacker could possibly use this issue to bypass PAuth. This issue only affected Ubuntu 19.10.
    (CVE-2020-10702)

    Ziming Zhang discovered that QEMU incorrectly handled ATI VGA emulation. A local attacker in a guest could     use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu     20.04 LTS. (CVE-2020-11869)

    Aviv Sasson discovered that QEMU incorrectly handled Slirp networking. A remote attacker could use this     issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This     issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10. (CVE-2020-1983)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service or the execution of arbitrary code.

This update for qemu fixes the following issues :

  - CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu()     routine while emulating IRC and other protocols     (bsc#1161066).

  - CVE-2019-15034: Fixed a buffer overflow in     hw/display/bochs-display.c due to improper PCI config     space allocation (bsc#1166379).

  - CVE-2020-1711: Fixed an out of bounds heap buffer access     iscsi_co_block_status() routine which could have allowed     a remote denial of service or arbitrary code with     privileges of the QEMU process on the host     (bsc#1166240).

  - CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu()     routine while emulating the identification protocol and     copying message data to a socket buffer (bsc#1123156).

  - CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu()     routine while emulating IRC and other protocols     (bsc#1163018).

  - CVE-2019-20382: Fixed a memory leak in the VNC display     driver which could have led to exhaustion of the host     memory leading to a potential Denial of service     (bsc#1165776).

  - Fixed a live migration error (bsc#1154790).

  - Fixed an issue where migrating VMs on KVM gets missing     features:ospke error (bsc#1162729).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for qemu fixes the following issues :

CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1161066).

CVE-2019-15034: Fixed a buffer overflow in hw/display/bochs-display.c due to improper PCI config space allocation (bsc#1166379).

CVE-2020-1711: Fixed an out of bounds heap buffer access iscsi_co_block_status() routine which could have allowed a remote denial of service or arbitrary code with privileges of the QEMU process on the host (bsc#1166240).

CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() routine while emulating the identification protocol and copying message data to a socket buffer (bsc#1123156).

CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1163018).

CVE-2019-20382: Fixed a memory leak in the VNC display driver which could have led to exhaustion of the host memory leading to a potential Denial of service (bsc#1165776).

Fixed live migration errors (bsc#1154790, bsc#1156794, bsc#1156642).

Fixed an issue where migrating VMs on KVM gets missing features:ospke error (bsc#1162729).

Fixed an issue where booting up a guest system with mdev passthrough device as installation device was failing (bsc#1158880).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1161066).

CVE-2019-15034: Fixed a buffer overflow in hw/display/bochs-display.c due to improper PCI config space allocation (bsc#1166379).

CVE-2020-1711: Fixed an out of bounds heap buffer access iscsi_co_block_status() routine which could have allowed a remote denial of service or arbitrary code with privileges of the QEMU process on the host (bsc#1166240).

CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() routine while emulating the identification protocol and copying message data to a socket buffer (bsc#1123156).

CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1163018).

CVE-2019-20382: Fixed a memory leak in the VNC display driver which could have led to exhaustion of the host memory leading to a potential Denial of service (bsc#1165776).

Fixed a live migration error (bsc#1154790).

Fixed an issue where migrating VMs on KVM gets missing features:ospke error (bsc#1162729).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
146269	Oracle Linux 7 : qemu (ELSA-2021-9034)	Nessus	Oracle Linux Local Security Checks	medium
136803	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-4372-1)	Nessus	Ubuntu Local Security Checks	medium
136069	Debian DSA-4665-1 : qemu - security update	Nessus	Debian Local Security Checks	medium
135265	openSUSE Security Update : qemu (openSUSE-2020-468)	Nessus	SuSE Local Security Checks	high
135169	SUSE SLES12 Security Update : qemu (SUSE-SU-2020:0845-1)	Nessus	SuSE Local Security Checks	high
135168	SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2020:0844-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-15034

medium

Tenable Plugins

medium

medium

medium

high

high

high