CVE-2020-1983

A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.

A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• QEMU: slirp: use-after-free in ip_reass() function in ip_input.c (CVE-2020-1983)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

The following packages have been upgraded to a later upstream version: hivex (1.3.18), libguestfs (1.40.2), libguestfs-winsupport (8.2), libvirt (6.0.0), libvirt-dbus (1.3.0), libvirt-python (6.0.0), nbdkit (1.16.2), perl-Sys-Virt (6.0.0), qemu-kvm (4.2.0), seabios (1.13.0), SLOF (20191022). (BZ#1810193, BZ#1844296)

Security Fix(es):

• libvirt: leak of /dev/mapper/control into QEMU guests (CVE-2020-14339)

• QEMU: Slirp: use-after-free during packet reassembly (CVE-2019-15890)

• libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent (CVE-2019-20485)

• QEMU: slirp: use-after-free in ip_reass() function in ip_input.c (CVE-2020-1983)

• libvirt: Potential denial of service via active pool without target path (CVE-2020-10703)

• libvirt: leak of sensitive cookie information via dumpxml (CVE-2020-14301)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• QEMU: slirp: use-after-free in ip_reass() function in ip_input.c (CVE-2020-1983)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

The following packages have been upgraded to a later upstream version: hivex (1.3.18), libguestfs (1.40.2), libguestfs-winsupport (8.2), libvirt (6.0.0), libvirt-dbus (1.3.0), libvirt-python (6.0.0), nbdkit (1.16.2), perl-Sys-Virt (6.0.0), qemu-kvm (4.2.0), seabios (1.13.0), SLOF (20191022). (BZ#1810193, BZ#1844296)

Security Fix(es):

• libvirt: leak of /dev/mapper/control into QEMU guests (CVE-2020-14339)

• QEMU: Slirp: use-after-free during packet reassembly (CVE-2019-15890)

• libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent (CVE-2019-20485)

• QEMU: slirp: use-after-free in ip_reass() function in ip_input.c (CVE-2020-1983)

• libvirt: Potential denial of service via active pool without target path (CVE-2020-10703)

• libvirt: leak of sensitive cookie information via dumpxml (CVE-2020-14301)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This update for slirp4netns fixes the following issues:

Security issue fixed:

• CVE-2020-1983: Fixed a use-after-free in ip_reass (bsc#1170940).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for qemu fixes the following issues:

Security issue fixed:

• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).

Non-security issues fixed:

• Fixed an issue where limiting the memory bandwidth was not possible (bsc#1167816).
• Fixed the issue that s390x could not read IPL channel program when using dasd as boot device (bsc#1158880).
• Miscellaneous fixes to the in-package support documentation.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the libslirp-devel-4.6.1+7-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the qemu-6.1.0-32.1 package on the GA media of openSUSE Tumbleweed.

This update for slirp4netns fixes the following issues:

Security issue fixed:

• CVE-2020-1983: Fixed a use-after-free in ip_reass (bsc#1170940).

This update for kvm fixes the following issues:

Security issues fixed:

• CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation (bsc#1146873).
• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• CVE-2019-15890: Fixed a use-after-free during packet reassembly in slirp (bsc#1149811).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2019-20382: Fixed a potential DoS due to a memory leak in VNC disconnect (bsc#1165776).
• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

Non-security issue fixed:

• Miscellaneous fixes to the in-package support documentation.

This update for qemu fixes the following issues:

Security issue fixed:

• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).

Non-security issues fixed:

• Fixed an issue where limiting the memory bandwidth was not possible (bsc#1167816).
• Fixed the issue that s390x could not read IPL channel program when using dasd as boot device (bsc#1158880).
• Miscellaneous fixes to the in-package support documentation.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation (bsc#1146873).
• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• CVE-2019-15890: Fixed a use-after-free during packet reassembly in slirp (bsc#1149811).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

This update for qemu fixes the following issues:

Security issue fixed:

• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).

Non-security issue fixed:

• Fixed an issue where limiting the memory bandwidth was not possible (bsc#1167816).
• Miscellaneous fixes to the in-package support documentation.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2019-20382: Fixed a potential DoS due to a memory leak in VNC disconnect (bsc#1165776).
• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

Non-security issue fixed:

• Miscellaneous fixes to the in-package support documentation.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation (bsc#1146873).
• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• CVE-2019-15890: Fixed a use-after-free during packet reassembly in slirp (bsc#1149811).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation (bsc#1146873).
• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• CVE-2019-15890: Fixed a use-after-free during packet reassembly in slirp (bsc#1149811).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

Non-security issue fixed:

• Make sure that required memory is mapped properly during an incoming migration of a Xen HVM domU (bsc#1160024).

This update for kvm fixes the following issues:

• Fix OOB read and write due to integer overflow in sm501_2d_operation() in hw/display/sm501.c (CVE-2020-12829, bsc#1172385)
• Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)
• Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)
• Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)
• Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)
• Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)
• Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)
• Fix DoS in e1000 emulated device (CVE-2021-20257 bsc#1182577)
• Fix OOB access in SLIRP ARP packet processing (CVE-2020-29130, bsc#1179467)
• Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441)
• Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)
• Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
• Fix use-after-free in slirp (CVE-2019-15890 bsc#1149811)
• Fix for similar problems as for the original fix prompting this issue (CVE-2019-6778 bsc#1123156)
• Fix potential OOB accesses in slirp (CVE-2020-8608 bsc#1163018 CVE-2020-7039 bsc#1161066)
• Fix use after free in slirp (CVE-2020-1983 bsc#1170940)
• Fix potential DOS in lsi scsi controller emulation (CVE-2019-12068 bsc#1146873)
• Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384)
• Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)

It was discovered that QEMU incorrectly handled bochs-display devices. A local attacker in a guest could use this to cause a denial of service or possibly execute arbitrary code in the host. This issue only affected Ubuntu 19.10. (CVE-2019-15034)

It was discovered that QEMU incorrectly handled memory during certain VNC operations. A remote attacker could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10. (CVE-2019-20382)

It was discovered that QEMU incorrectly generated QEMU Pointer Authentication signatures on ARM. A local attacker could possibly use this issue to bypass PAuth. This issue only affected Ubuntu 19.10. (CVE-2020-10702)

Ziming Zhang discovered that QEMU incorrectly handled ATI VGA emulation. A local attacker in a guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-11869)

Aviv Sasson discovered that QEMU incorrectly handled Slirp networking. A remote attacker could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10. (CVE-2020-1983)

It was discovered that QEMU incorrectly handled memory during certain VNC operations. A remote attacker could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-20382)

It was discovered that QEMU incorrectly handled certain memory copy operations when loading ROM contents. If a user were tricked into running an untrusted kernel image, a remote attacker could possibly use this issue to run arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-13765)

Aviv Sasson discovered that QEMU incorrectly handled Slirp networking. A remote attacker could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-1983)

It was discovered that the SLiRP networking implementation of the QEMU emulator did not properly manage memory under certain circumstances. An attacker could use this to cause a heap-based buffer overflow or other out- of-bounds access, which can lead to a denial of service (application crash) or potential execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-7039)

It was discovered that the SLiRP networking implementation of the QEMU emulator misuses snprintf return values. An attacker could use this to cause a denial of service (application crash) or potentially execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-8608)

It was discovered that QEMU SLiRP networking incorrectly handled certain udp packets. An attacker inside a guest could possibly use this issue to leak sensitive information from the host. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3592, CVE-2021-3594)

It was discovered that QEMU had a DMA reentrancy issue, leading to a use-after-free vulnerability. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-3019)

It was discovered that QEMU had a flaw in Virtio PCI Bindings, leading to a triggerable crash via vhost_net_stop. An attacker inside a guest could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-4693)

It was discovered that QEMU incorrectly handled memory in virtio-sound, leading to a heap-based buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-7730)