Detections
Analytics
SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2021:1893-1)
medium Nessus Plugin ID 150414
Language:
Synopsis
The remote SUSE host is missing one or more security updates.Description
The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1893-1 advisory.- libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. (CVE-2019-15890)
- An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1. (CVE-2020-10756)
- An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host. (CVE-2020-14364)
- QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case. (CVE-2020-25085)
- A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service. (CVE-2020-25723)
- ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. (CVE-2020-29129)
- slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. (CVE-2020-29130)
- In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code. (CVE-2020-8608)
- An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2021-20257)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
https://bugzilla.suse.com/1149813
https://bugzilla.suse.com/1163019
https://bugzilla.suse.com/1172380
https://bugzilla.suse.com/1175534
https://bugzilla.suse.com/1176681
https://bugzilla.suse.com/1178683
https://bugzilla.suse.com/1178935
https://bugzilla.suse.com/1179477
https://bugzilla.suse.com/1179484
https://bugzilla.suse.com/1182846
https://bugzilla.suse.com/1182975
https://bugzilla.suse.com/1183979
https://bugzilla.suse.com/1186290
https://www.suse.com/security/cve/CVE-2019-15890
https://www.suse.com/security/cve/CVE-2020-10756
https://www.suse.com/security/cve/CVE-2020-14364
https://www.suse.com/security/cve/CVE-2020-25085
https://www.suse.com/security/cve/CVE-2020-25707
https://www.suse.com/security/cve/CVE-2020-25723
https://www.suse.com/security/cve/CVE-2020-29129
https://www.suse.com/security/cve/CVE-2020-29130
https://www.suse.com/security/cve/CVE-2020-8608
https://www.suse.com/security/cve/CVE-2021-20257
Plugin Details
Severity: Medium
ID: 150414
File Name: suse_SU-2021-1893-1.nasl
Version: 1.7
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 6/9/2021
Updated: 7/13/2023
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2020-8608
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.9
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2020-10756
Vulnerability Information
CPE: p-cpe:/a:novell:suse_linux:qemu-block-ssh, p-cpe:/a:novell:suse_linux:qemu-sgabios, p-cpe:/a:novell:suse_linux:qemu-lang, p-cpe:/a:novell:suse_linux:qemu-block-iscsi, p-cpe:/a:novell:suse_linux:qemu-audio-alsa, p-cpe:/a:novell:suse_linux:qemu-ppc, p-cpe:/a:novell:suse_linux:qemu-block-curl, p-cpe:/a:novell:suse_linux:qemu-microvm, p-cpe:/a:novell:suse_linux:qemu-kvm, p-cpe:/a:novell:suse_linux:qemu-guest-agent, p-cpe:/a:novell:suse_linux:qemu-seabios, p-cpe:/a:novell:suse_linux:qemu, p-cpe:/a:novell:suse_linux:qemu-ui-curses, p-cpe:/a:novell:suse_linux:qemu-ipxe, p-cpe:/a:novell:suse_linux:qemu-vgabios, p-cpe:/a:novell:suse_linux:qemu-arm, p-cpe:/a:novell:suse_linux:qemu-block-rbd, p-cpe:/a:novell:suse_linux:qemu-audio-pa, cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:qemu-x86, p-cpe:/a:novell:suse_linux:qemu-ui-gtk, p-cpe:/a:novell:suse_linux:qemu-ui-spice-app, p-cpe:/a:novell:suse_linux:qemu-tools, p-cpe:/a:novell:suse_linux:qemu-s390
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/8/2021
Vulnerability Publication Date: 9/6/2019
Reference Information
CVE: CVE-2019-15890, CVE-2020-10756, CVE-2020-14364, CVE-2020-25085, CVE-2020-25707, CVE-2020-25723, CVE-2020-29129, CVE-2020-29130, CVE-2020-8608, CVE-2021-20257, CVE-2021-3419
IAVB: 2020-B-0063-S, 2020-B-0075-S
SuSE: SUSE-SU-2021:1893-1