CVE-2021-3594

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• QEMU: net: e1000e: use-after-free while sending packets (CVE-2020-15859)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp) (CVE-2021-3592)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6) (CVE-2021-3593)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp) (CVE-2021-3594)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp) (CVE-2021-3595)

• libvirt: Insecure sVirt label generation (CVE-2021-3631)

• libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API (CVE-2021-3667)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• QEMU: net: e1000e: use-after-free while sending packets (CVE-2020-15859)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp) (CVE-2021-3592)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6) (CVE-2021-3593)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp) (CVE-2021-3594)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp) (CVE-2021-3595)

• libvirt: Insecure sVirt label generation (CVE-2021-3631)

• libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API (CVE-2021-3667)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Invalid pointer initialization issues were found in the SLiRP networking implementation of QEMU.

In the bootp_input() function while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3592)

In the udp6_input() function while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3593)

In the udp_input() function while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3594)

In the tftp_input() function while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3595)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3527: usb: unbounded stack allocation in usbredir (bsc#1186012)
• CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
• CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
• CVE-2021-3682: usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145)
• CVE-2020-35503: NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432)
• CVE-2020-35504,CVE-2020-35505,CVE-2020-35506: NULL pointer dereference in ESP (bsc#1180433 bsc#1180434 bsc#1180435)
• CVE-2021-20255: eepro100: stack overflow via infinite recursion (bsc#1182651)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
• CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
• CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
• CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
• CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
• CVE-2020-25085: Fix out-of-bounds access issue while doing multi block SDMA (bsc#1176681)

Other issues fixed:

• QEMU BIOS fails to read stage2 loader (on s390x)(bsc#1186290)
• Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)

These are all security issues fixed in the apr-devel-1.7.0-2.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libslirp-devel-4.7.0+44-3.1 package on the GA media of openSUSE Tumbleweed.

This update for kvm fixes the following issues:

• CVE-2021-3594: invalid pointer initialization may lead to information disclosure in slirp (udp) (bsc#1187367)
• CVE-2021-3592: invalid pointer initialization may lead to information disclosure (bootp). (bsc#1187364)
• CVE-2021-3416: infinite loop in loopback mode may lead to stack overflow. (bsc#1186473)
• CVE-2020-15469: MMIO ops null pointer dereference may lead to DoS. (bsc#1173612)
• CVE-2020-11947: iscsi_aio_ioctl_cb in block/iscsi.c has a heap-based buffer over-read. (bsc#1180523)
• CVE-2021-20221: out-of-bound heap buffer access via an interrupt ID field. (bsc#1181933)
• CVE-2020-25707: infinite loop in e1000e_write_packet_to_guest() in hw/net/e1000e_core.c. (bsc#1178683)
• CVE-2020-15863: stack-based overflow in xgmac_enet_send() in hw/net/xgmac.c. (bsc#1174386)

This update for kvm fixes the following issues:

• CVE-2021-3594: invalid pointer initialization may lead to information disclosure in slirp (udp) (bsc#1187367)
• CVE-2021-3592: invalid pointer initialization may lead to information disclosure (bootp). (bsc#1187364)
• CVE-2021-3416: infinite loop in loopback mode may lead to stack overflow. (bsc#1186473)
• CVE-2020-15469: MMIO ops null pointer dereference may lead to DoS. (bsc#1173612)
• CVE-2020-11947: iscsi_aio_ioctl_cb in block/iscsi.c has a heap-based buffer over-read. (bsc#1180523)
• CVE-2021-20221: out-of-bound heap buffer access via an interrupt ID field. (bsc#1181933)
• CVE-2020-25707: infinite loop in e1000e_write_packet_to_guest() in hw/net/e1000e_core.c. (bsc#1178683)
• CVE-2020-15863: stack-based overflow in xgmac_enet_send() in hw/net/xgmac.c. (bsc#1174386)

This update for xen fixes the following issues:

• CVE-2021-0089: Fixed Speculative Code Store Bypass (XSA-375) (bsc#1186433).
• CVE-2021-20255: Fixed stack overflow via infinite recursion in eepro100 (bsc#1182654).
• CVE-2021-28690: Fixed x86 TSX Async Abort protections not restored after S3 (XSA-377) (bsc#1186434).
• CVE-2021-28692: Fixed inappropriate x86 IOMMU timeout detection / handling (XSA-373) (bsc#1186429).
• CVE-2021-28697: Fixed grant table v2 status pages may remain accessible after de-allocation (XSA-379) (bsc#1189376).
• CVE-2021-28698: Fixed long running loops in grant table handling. (XSA-380) (bsc#1189378).
• CVE-2021-28701: Fixed race condition in XENMAPSPACE_grant_table handling (XSA-384) (bsc#1189632).
• CVE-2021-28703: Fixed grant table v2 status pages may remain accessible after de-allocation (take two) (XSA-387) (bsc#1192555).
• CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559).
• CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554).
• CVE-2021-3527: Fixed unbounded stack allocation in usbredir (bsc#1186013).
• CVE-2021-3592: Fixed invalid pointer initialization may lead to information disclosure in slirp (bootp) (bsc#1187369).
• CVE-2021-3594: Fixed invalid pointer initialization may lead to information disclosure in slirp (udp) (bsc#1187378).
• CVE-2021-3595: Fixed invalid pointer initialization may lead to information disclosure in slirp (tftp) (bsc#1187376).
• CVE-2021-3682: Fixed free call on invalid pointer in usbredir bufp_alloc (bsc#1189150).
• CVE-2021-3930: Fixed off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c (bsc#1192526).

This update for qemu fixes the following issues:

• CVE-2021-3595: Fixed an invalid pointer initialization may lead to information disclosure (tftp). (bsc#1187366)
• CVE-2021-3592: Fixed an invalid pointer initialization may lead to information disclosure (bootp). (bsc#1187364)
• CVE-2021-3594: Fixed an invalid pointer initialization may lead to information disclosure (udp). (bsc#1187367)
• CVE-2021-3593: Fixed an invalid pointer initialization may lead to information disclosure (udp6). (bsc#1187365)
• CVE-2021-3611: Fixed a segmentation fault due to stack overflow. (bsc#1187529)

This update for qemu fixes the following issues:

Security fixes:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3582: Fixed possible mremap overflow in the pvrdma (bsc#1187499)
• CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
• CVE-2021-3608: Fixed the ring init error flow (bsc#1187538)
• CVE-2021-3611: Fixed intel-hda segmentation fault due to stack overflow (bsc#1187529)

Other fixes:

• Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
• CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
• CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
• CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
• CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
• CVE-2020-25085: Fix out-of-bounds access issue while doing multi block SDMA (bsc#1176681)

Other issues fixed:

• QEMU BIOS fails to read stage2 loader (on s390x)(bsc#1186290)
• Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)

This update for xen fixes the following issues:

Security issues fixed:

• CVE-2021-28693: xen/arm: Boot modules are not scrubbed (bsc#1186428)
• CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling (bsc#1186429)
• CVE-2021-0089: xen: Speculative Code Store Bypass (bsc#1186433)
• CVE-2021-28690: xen: x86: TSX Async Abort protections not restored after S3 (bsc#1186434)
• CVE-2021-20255: Fixed stack overflow via infinite recursion in eepro100 (bsc#1182654)
• CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: IOMMU page mapping issues on x86 (XSA-378)(bsc#1189373).
• CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation (XSA-379)(bsc#1189376).
• CVE-2021-28698: long running loops in grant table handling (XSA-380)(bsc#1189378).
• CVE-2021-28699: inadequate grant-v2 status frames array bounds check (XSA-382)(bsc#1189380).
• CVE-2021-28700: No memory limit for dom0less domUs (XSA-383)(bsc#1189381).
• CVE-2021-3592: slirp: invalid pointer initialization may lead to information disclosure (bootp)(bsc#1187369).
• CVE-2021-3594: slirp: invalid pointer initialization may lead to information disclosure (udp)(bsc#1187378).
• CVE-2021-3595: slirp: invalid pointer initialization may lead to information disclosure (tftp)(bsc#1187376).

Other issues fixed:

• Fixed 'Panic on CPU 0: IO-APIC + timer doesn't work!' (bsc#1180491)

• Fixed an issue with xencommons, where file format expecations by fillup did not allign (bsc#1185682)

• Upstream bug fixes (bsc#1027519)

• Dom0 hangs when pinning CPUs for dom0 with HVM guest (bsc#1179246).

• Fixed Xen SLES11SP4 guest hangs on cluster (bsc#1188050).

• Fixed PVHVM SLES12 SP5 - NMI Watchdog CPU Stuck (bsc#1180846).

• Core cannot be opened when using xl dump-core of VM with PTF (bsc#1183243)

• Prevent superpage allocation in the LAPIC and ACPI_INFO range (bsc#1189882).

This update for xen fixes the following issues:

Security issues fixed:

• CVE-2021-28698: long running loops in grant table handling (XSA-380)(bsc#1189378).

• CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation (XSA-379)(bsc#1189376).

• CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: IOMMU page mapping issues on x86 (XSA-378)(bsc#1189373).

• CVE-2021-28699: inadequate grant-v2 status frames array bounds check (XSA-382)(bsc#1189380).

• CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling (bsc#1186429)

• CVE-2021-28690: xen: x86: TSX Async Abort protections not restored after S3 (bsc#1186434)

• CVE-2021-0089: xen: Speculative Code Store Bypass (bsc#1186433)

• CVE-2021-20255: Fixed stack overflow via infinite recursion in eepro100 (bsc#1182654)

• CVE-2021-3592: slirp: invalid pointer initialization may lead to information disclosure (bootp)(bsc#1187369).

• CVE-2021-3594: slirp: invalid pointer initialization may lead to information disclosure (udp)(bsc#1187378).

• CVE-2021-3595: slirp: invalid pointer initialization may lead to information disclosure (tftp)(bsc#1187376).

• CVE-2021-3308: Fixed IRQ vector leak on x86 (XSA-360)(bsc#1181254).

• Prevent superpage allocation in the LAPIC and ACPI_INFO range (bsc#1189882).

This update for xen fixes the following issues:

• CVE-2021-3594: slirp: invalid pointer initialization may lead to information disclosure (udp)(bsc#1187378).

• CVE-2021-3595: slirp: invalid pointer initialization may lead to information disclosure (tftp)(bsc#1187376).

• CVE-2021-28698: long running loops in grant table handling (XSA-380)(bsc#1189378).

• CVE-2021-28699: inadequate grant-v2 status frames array bounds check (XSA-382)(bsc#1189380).

• CVE-2021-20255: Fixed stack overflow via infinite recursion in eepro100 (bsc#1182654)

• CVE-2021-28690: xen: x86: TSX Async Abort protections not restored after S3 (bsc#1186434)

• CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling (bsc#1186429)

• CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: IOMMU page mapping issues on x86 (XSA-378)(bsc#1189373).

• CVE-2021-0089: xen: Speculative Code Store Bypass (bsc#1186433)

• CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation (XSA-379)(bsc#1189376).

• CVE-2021-3592: slirp: invalid pointer initialization may lead to information disclosure (bootp)(bsc#1187369).

• Prevent superpage allocation in the LAPIC and ACPI_INFO range (bsc#1189882).

This update for xen fixes the following issues:

• CVE-2021-28701: Fixed race condition in XENMAPSPACE_grant_table handling (XSA-384) (bsc#1189632).

• CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: Fixed IOMMU page mapping issues on x86 (XSA-378)(bsc#1189373).

• CVE-2021-28697: Fixed grant table v2 status pages that may remain accessible after de-allocation (XSA-379)(bsc#1189376).

• CVE-2021-28698: Fixed long running loops in grant table handling (XSA-380)(bsc#1189378).

• CVE-2021-20255: Fixed eepro100 stack overflow via infinite recursion (bsc#1182654).

• CVE-2021-3592: Fixed invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187369).

• CVE-2021-3594: Fixed invalid pointer initialization may lead to information disclosure (udp) (bsc#1187378).

• CVE-2021-3595: Fixed invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187376).

• CVE-2021-28692: Fixed inappropriate x86 IOMMU timeout detection / handling (XSA-373)(bsc#1186429).

• CVE-2021-0089: Fixed Speculative Code Store Bypass (XSA-375)(bsc#1186433).

• CVE-2021-28690: Fixed x86 TSX Async Abort protections not restored after S3 (XSA-377)(bsc#1186434).

• Prevent superpage allocation in the LAPIC and ACPI_INFO range (bsc#1189882).

This update for libslirp fixes the following issues:

• CVE-2021-3592: Fixed invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364).
• CVE-2021-3594: Fixed invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367).
• CVE-2021-3595: Fixed invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366).
• Fix a dhcp regression [bsc#1198773]

This update for libslirp fixes the following issues:

• CVE-2021-3592: Fixed invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364).
• CVE-2021-3594: Fixed invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367).
• CVE-2021-3595: Fixed invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366).
• Fix a dhcp regression [bsc#1198773]

Qiuhao Li discovered that libslirp incorrectly handled certain header data lengths. An attacker inside a guest could possibly use this issue to leak sensitive information from the host. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2020-29129, CVE-2020-29130)

It was discovered that libslirp incorrectly handled certain udp packets. An attacker inside a guest could possibly use this issue to leak sensitive information from the host. (CVE-2021-3592, CVE-2021-3593, CVE-2021-3594, CVE-2021-3595)

Lei Sun discovered that QEMU incorrectly handled certain MMIO operations. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-15469)

Wenxiang Qian discovered that QEMU incorrectly handled certain ATAPI commands. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 21.04. (CVE-2020-29443)

Cheolwoo Myung discovered that QEMU incorrectly handled SCSI device emulation. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-35504, CVE-2020-35505, CVE-2021-3392)

Alex Xu discovered that QEMU incorrectly handled the virtio-fs shared file system daemon. An attacker inside the guest could possibly use this issue to read and write to host devices. This issue only affected Ubuntu 20.10. (CVE-2020-35517)

It was discovered that QEMU incorrectly handled ARM Generic Interrupt Controller emulation. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-20221)

Alexander Bulekov, Cheolwoo Myung, Sergej Schumilo, Cornelius Aschermann, and Simon Werner discovered that QEMU incorrectly handled e1000 device emulation. An attacker inside the guest could possibly use this issue to cause QEMU to hang, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-20257)

It was discovered that QEMU incorrectly handled SDHCI controller emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, when QEMU is used in combination with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2021-3409)

It was discovered that QEMU incorrectly handled certain NIC emulation devices. An attacker inside the guest could possibly use this issue to cause QEMU to hang or crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-3416)

Remy Noel discovered that QEMU incorrectly handled the USB redirector device. An attacker inside the guest could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. (CVE-2021-3527)

It was discovered that QEMU incorrectly handled the virtio vhost-user GPU device. An attacker inside the guest could possibly use this issue to cause QEMU to consume resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3544)

It was discovered that QEMU incorrectly handled the virtio vhost-user GPU device. An attacker inside the guest could possibly use this issue to obtain sensitive host information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3545)

It was discovered that QEMU incorrectly handled the virtio vhost-user GPU device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, when QEMU is used in combination with libvirt, attackers would be isolated by the libvirt AppArmor profile. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3546)

It was discovered that QEMU incorrectly handled the PVRDMA device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, when QEMU is used in combination with libvirt, attackers would be isolated by the libvirt AppArmor profile. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3582,…

It was discovered that QEMU incorrectly handled memory during certain VNC operations. A remote attacker could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2019-20382)

It was discovered that QEMU incorrectly handled certain memory copy operations when loading ROM contents. If a user were tricked into running an untrusted kernel image, a remote attacker could possibly use this issue to run arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-13765)

Aviv Sasson discovered that QEMU incorrectly handled Slirp networking. A remote attacker could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-1983)

It was discovered that the SLiRP networking implementation of the QEMU emulator did not properly manage memory under certain circumstances. An attacker could use this to cause a heap-based buffer overflow or other out- of-bounds access, which can lead to a denial of service (application crash) or potential execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-7039)

It was discovered that the SLiRP networking implementation of the QEMU emulator misuses snprintf return values. An attacker could use this to cause a denial of service (application crash) or potentially execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-8608)

It was discovered that QEMU SLiRP networking incorrectly handled certain udp packets. An attacker inside a guest could possibly use this issue to leak sensitive information from the host. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3592, CVE-2021-3594)

It was discovered that QEMU had a DMA reentrancy issue, leading to a use-after-free vulnerability. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-3019)

It was discovered that QEMU had a flaw in Virtio PCI Bindings, leading to a triggerable crash via vhost_net_stop. An attacker inside a guest could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-4693)

It was discovered that QEMU incorrectly handled memory in virtio-sound, leading to a heap-based buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-7730)