CVE-2020-25085

QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.

QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.(CVE-2021-3416)

The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.(CVE-2021-3409)

A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.(CVE-2021-3392)

QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.(CVE-2020-25085)

QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZE case.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3546: Fix out-of-bounds write in virgl_cmd_get_capset (bsc#1185981)
• CVE-2021-3544: Fix memory leaks found in the virtio vhost-user GPU device (bsc#1186010)
• CVE-2021-3545: Fix information disclosure due to uninitialized memory read (bsc#1185990)
• CVE-2020-25085: Fix out-of-bounds access issue while doing multi block SDMA (bsc#1176681)
• CVE-2020-10756: Fix out-of-bounds read information disclosure in icmp6_send_echoreply(bsc#1172380)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975)

Non-security issues fixed:

• Fix issue where s390 guest fails to find zipl boot menu index (bsc#1183979)
• QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
• Host CPU microcode revision will be visible inside VMs when the proper CPU-model is used (jsc#SLE-17785):
• Fix testsuite error (bsc#1184574)
• Fix qemu crash with iothread when block commit after snapshot (bsc#1187013)
• Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)
• Use RCU to avoid race during scsi hotplug/hotunplug (bsc#1184574)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for qemu fixes the following issues:

• Switch method of splitting off hw-s390x-virtio-gpu-ccw.so as a module to what was accepted upstream (bsc#1181103)
• Fix OOB access in sdhci interface (CVE-2020-17380, bsc#1175144, CVE-2020-25085, bsc#1176681, CVE-2021-3409, bsc#1182282)
• Fix potential privilege escalation in virtiofsd tool (CVE-2021-20263, bsc#1183373)
• Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)
• Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)
• Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
• QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-3419, bsc#1182975)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
• CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
• CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
• CVE-2020-25085: Fix out-of-bounds access issue while doing multi block SDMA (bsc#1176681)

Other issues fixed:

• QEMU BIOS fails to read stage2 loader (on s390x)(bsc#1186290)
• Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)

These are all security issues fixed in the qemu-6.1.0-32.1 package on the GA media of openSUSE Tumbleweed.

This update for qemu fixes the following issues:

• Fix out-of-bounds access issue while doing multi block SDMA (CVE-2020-25085, bsc#1176681)
• Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380)
• QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
• Change dependency from CONFIG_VFIO back to CONFIG_LINUX (bsc#1179725)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975)

This update for qemu fixes the following issues:

• CVE-2020-25085: Fix out-of-bounds access issue while doing multi block SDMA (bsc#1176681)
• CVE-2020-10756: Fix out-of-bounds read information disclosure in icmp6_send_echoreply(bsc#1172380)
• Fix issue where s390 guest fails to find zipl boot menu index (bsc#1183979)
• QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
• Host CPU microcode revision will be visible inside VMs when the proper CPU-model is used (jsc#SLE-17785):
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975)

This update for qemu fixes the following issues:

• Switch method of splitting off hw-s390x-virtio-gpu-ccw.so as a module to what was accepted upstream (bsc#1181103)
• Fix OOB access in sdhci interface (CVE-2020-17380, bsc#1175144, CVE-2020-25085, bsc#1176681, CVE-2021-3409, bsc#1182282)
• Fix potential privilege escalation in virtiofsd tool (CVE-2021-20263, bsc#1183373)
• Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)
• Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)
• Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
• QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-3419, bsc#1182975)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
• CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
• CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
• CVE-2020-25085: Fix out-of-bounds access issue while doing multi block SDMA (bsc#1176681)

Other issues fixed:

• QEMU BIOS fails to read stage2 loader (on s390x)(bsc#1186290)
• Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)

This update for qemu fixes the following issues:

• bsc#1172033 (CVE-2020-13253)

• bsc#1180207 (CVE-2020-14394)

• bsc#1172382 (CVE-2020-13754)

• bsc#1198038 (CVE-2022-0216)

• bsc#1193880 (CVE-2021-3929)

• bsc#1197653 (CVE-2022-1050)

• bsc#1205808 (CVE-2022-4144), bsc#1198712 (CVE-2022-26354)

• bsc#1175144 (CVE-2020-17380, CVE-2020-25085, CVE-2021-3409), bsc#1185000 (CVE-2021-3507), bsc#1201367, CVE-2022-35414

• About bsc#1175144, see also bsc#1182282 (CVE-2021-3409)

• bsc#1198035, CVE-2021-4206

Alexander Bulekov discovered that QEMU incorrectly handled SDHCI device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2020-17380)

Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that QEMU incorrectly handled USB device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-25084)

Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that QEMU incorrectly handled SDHCI device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-25085)

Gaoning Pan, Yongkang Jia, and Yi Ren discovered that QEMU incorrectly handled USB device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-25624)

It was discovered that QEMU incorrectly handled USB device emulation. An attacker inside the guest could use this issue to cause QEMU to hang, resulting in a denial of service. (CVE-2020-25625)

Cheolwoo Myung discovered that QEMU incorrectly handled USB device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-25723)

Gaoning Pan discovered that QEMU incorrectly handled ATI graphics device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2020-27616)

Gaoning Pan discovered that QEMU incorrectly handled networking. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-27617)