SUSE SLES15 / openSUSE 15 Security Update : qemu (SUSE-SU-2023:3721-1)

high Nessus Plugin ID 181777

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3721-1 advisory.

- hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. (CVE-2020-13754)

- An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. (CVE-2021-3638)

- A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0. (CVE-2021-3750)

- A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host. (CVE-2021-3929)

- A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition. (CVE-2022-1050)

- A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results.
Affected QEMU versions <= 6.2.0. (CVE-2022-26354)

- A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free. (CVE-2023-0330)

- A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario. (CVE-2021-3416) (CVE-2023-2861)

- A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.
(CVE-2023-3180)

- A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated client to cause a denial of service. (CVE-2023-3354)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 181777

File Name: suse_SU-2023-3721-1.nasl

Version: 1.3

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 9/22/2023

Updated: 3/15/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2022-1050

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:qemu-block-ssh, p-cpe:/a:novell:suse_linux:qemu-sgabios, p-cpe:/a:novell:suse_linux:qemu-lang, p-cpe:/a:novell:suse_linux:qemu-block-iscsi, p-cpe:/a:novell:suse_linux:qemu-audio-alsa, p-cpe:/a:novell:suse_linux:qemu-ppc, p-cpe:/a:novell:suse_linux:qemu-block-curl, p-cpe:/a:novell:suse_linux:qemu-microvm, p-cpe:/a:novell:suse_linux:qemu-kvm, p-cpe:/a:novell:suse_linux:qemu-guest-agent, p-cpe:/a:novell:suse_linux:qemu-seabios, p-cpe:/a:novell:suse_linux:qemu, p-cpe:/a:novell:suse_linux:qemu-ui-curses, p-cpe:/a:novell:suse_linux:qemu-ipxe, p-cpe:/a:novell:suse_linux:qemu-vgabios, p-cpe:/a:novell:suse_linux:qemu-arm, p-cpe:/a:novell:suse_linux:qemu-block-rbd, p-cpe:/a:novell:suse_linux:qemu-audio-pa, cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:qemu-x86, p-cpe:/a:novell:suse_linux:qemu-ui-gtk, p-cpe:/a:novell:suse_linux:qemu-ui-spice-app, p-cpe:/a:novell:suse_linux:qemu-tools, p-cpe:/a:novell:suse_linux:qemu-s390

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/21/2023

Vulnerability Publication Date: 6/2/2020

Reference Information

CVE: CVE-2020-13754, CVE-2021-3638, CVE-2021-3750, CVE-2021-3929, CVE-2022-1050, CVE-2022-26354, CVE-2023-0330, CVE-2023-2861, CVE-2023-3180, CVE-2023-3354

IAVB: 2020-B-0041-S, 2022-B-0057-S, 2023-B-0019-S, 2023-B-0058-S, 2023-B-0073-S

SuSE: SUSE-SU-2023:3721-1

Detections

Analytics