CVE-2021-3595

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality.(CVE-2021-3593)

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality.(CVE-2021-3592)

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality.(CVE-2021-3595)

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• QEMU: net: e1000e: use-after-free while sending packets (CVE-2020-15859)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp) (CVE-2021-3592)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6) (CVE-2021-3593)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp) (CVE-2021-3594)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp) (CVE-2021-3595)

• libvirt: Insecure sVirt label generation (CVE-2021-3631)

• libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API (CVE-2021-3667)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• QEMU: net: e1000e: use-after-free while sending packets (CVE-2020-15859)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp) (CVE-2021-3592)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6) (CVE-2021-3593)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp) (CVE-2021-3594)

• QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp) (CVE-2021-3595)

• libvirt: Insecure sVirt label generation (CVE-2021-3631)

• libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API (CVE-2021-3667)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Invalid pointer initialization issues were found in the SLiRP networking implementation of QEMU.

In the bootp_input() function while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3592)

In the udp6_input() function while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3593)

In the udp_input() function while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3594)

In the tftp_input() function while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3595)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3527: usb: unbounded stack allocation in usbredir (bsc#1186012)
• CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
• CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
• CVE-2021-3682: usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145)
• CVE-2020-35503: NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432)
• CVE-2020-35504,CVE-2020-35505,CVE-2020-35506: NULL pointer dereference in ESP (bsc#1180433 bsc#1180434 bsc#1180435)
• CVE-2021-20255: eepro100: stack overflow via infinite recursion (bsc#1182651)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
• CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
• CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
• CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
• CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
• CVE-2020-25085: Fix out-of-bounds access issue while doing multi block SDMA (bsc#1176681)

Other issues fixed:

• QEMU BIOS fails to read stage2 loader (on s390x)(bsc#1186290)
• Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)

This update for xen fixes the following issues:

• CVE-2021-0089: Fixed Speculative Code Store Bypass (XSA-375) (bsc#1186433).
• CVE-2021-20255: Fixed stack overflow via infinite recursion in eepro100 (bsc#1182654).
• CVE-2021-28690: Fixed x86 TSX Async Abort protections not restored after S3 (XSA-377) (bsc#1186434).
• CVE-2021-28692: Fixed inappropriate x86 IOMMU timeout detection / handling (XSA-373) (bsc#1186429).
• CVE-2021-28697: Fixed grant table v2 status pages may remain accessible after de-allocation (XSA-379) (bsc#1189376).
• CVE-2021-28698: Fixed long running loops in grant table handling. (XSA-380) (bsc#1189378).
• CVE-2021-28701: Fixed race condition in XENMAPSPACE_grant_table handling (XSA-384) (bsc#1189632).
• CVE-2021-28703: Fixed grant table v2 status pages may remain accessible after de-allocation (take two) (XSA-387) (bsc#1192555).
• CVE-2021-28705, CVE-2021-28709: Fixed issues with partially successful P2M updates on x86 (XSA-389) (bsc#1192559).
• CVE-2021-28706: Fixed guests may exceed their designated memory limit (XSA-385) (bsc#1192554).
• CVE-2021-3527: Fixed unbounded stack allocation in usbredir (bsc#1186013).
• CVE-2021-3592: Fixed invalid pointer initialization may lead to information disclosure in slirp (bootp) (bsc#1187369).
• CVE-2021-3594: Fixed invalid pointer initialization may lead to information disclosure in slirp (udp) (bsc#1187378).
• CVE-2021-3595: Fixed invalid pointer initialization may lead to information disclosure in slirp (tftp) (bsc#1187376).
• CVE-2021-3682: Fixed free call on invalid pointer in usbredir bufp_alloc (bsc#1189150).
• CVE-2021-3930: Fixed off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c (bsc#1192526).

This update for qemu fixes the following issues:

• CVE-2021-3595: Fixed an invalid pointer initialization may lead to information disclosure (tftp). (bsc#1187366)
• CVE-2021-3592: Fixed an invalid pointer initialization may lead to information disclosure (bootp). (bsc#1187364)
• CVE-2021-3594: Fixed an invalid pointer initialization may lead to information disclosure (udp). (bsc#1187367)
• CVE-2021-3593: Fixed an invalid pointer initialization may lead to information disclosure (udp6). (bsc#1187365)
• CVE-2021-3611: Fixed a segmentation fault due to stack overflow. (bsc#1187529)

This update for qemu fixes the following issues:

Security fixes:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3582: Fixed possible mremap overflow in the pvrdma (bsc#1187499)
• CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
• CVE-2021-3608: Fixed the ring init error flow (bsc#1187538)
• CVE-2021-3611: Fixed intel-hda segmentation fault due to stack overflow (bsc#1187529)

Other fixes:

• Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
• CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
• CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3595: Fixed slirp: invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366)
• CVE-2021-3592: Fix for slirp: invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364)
• CVE-2021-3594: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367)
• CVE-2021-3593: Fix for slirp: invalid pointer initialization may lead to information disclosure (udp6) (bsc#1187365)
• CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499)
• CVE-2021-3607: Ensure correct input on ring init (bsc#1187539)
• CVE-2021-3608: Fix the ring init error flow (bsc#1187538)
• CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529)
• CVE-2020-25085: Fix out-of-bounds access issue while doing multi block SDMA (bsc#1176681)

Other issues fixed:

• QEMU BIOS fails to read stage2 loader (on s390x)(bsc#1186290)
• Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)

This update for xen fixes the following issues:

Security issues fixed:

• CVE-2021-28693: xen/arm: Boot modules are not scrubbed (bsc#1186428)
• CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling (bsc#1186429)
• CVE-2021-0089: xen: Speculative Code Store Bypass (bsc#1186433)
• CVE-2021-28690: xen: x86: TSX Async Abort protections not restored after S3 (bsc#1186434)
• CVE-2021-20255: Fixed stack overflow via infinite recursion in eepro100 (bsc#1182654)
• CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: IOMMU page mapping issues on x86 (XSA-378)(bsc#1189373).
• CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation (XSA-379)(bsc#1189376).
• CVE-2021-28698: long running loops in grant table handling (XSA-380)(bsc#1189378).
• CVE-2021-28699: inadequate grant-v2 status frames array bounds check (XSA-382)(bsc#1189380).
• CVE-2021-28700: No memory limit for dom0less domUs (XSA-383)(bsc#1189381).
• CVE-2021-3592: slirp: invalid pointer initialization may lead to information disclosure (bootp)(bsc#1187369).
• CVE-2021-3594: slirp: invalid pointer initialization may lead to information disclosure (udp)(bsc#1187378).
• CVE-2021-3595: slirp: invalid pointer initialization may lead to information disclosure (tftp)(bsc#1187376).

Other issues fixed:

• Fixed 'Panic on CPU 0: IO-APIC + timer doesn't work!' (bsc#1180491)

• Fixed an issue with xencommons, where file format expecations by fillup did not allign (bsc#1185682)

• Upstream bug fixes (bsc#1027519)

• Dom0 hangs when pinning CPUs for dom0 with HVM guest (bsc#1179246).

• Fixed Xen SLES11SP4 guest hangs on cluster (bsc#1188050).

• Fixed PVHVM SLES12 SP5 - NMI Watchdog CPU Stuck (bsc#1180846).

• Core cannot be opened when using xl dump-core of VM with PTF (bsc#1183243)

• Prevent superpage allocation in the LAPIC and ACPI_INFO range (bsc#1189882).

This update for xen fixes the following issues:

Security issues fixed:

• CVE-2021-28698: long running loops in grant table handling (XSA-380)(bsc#1189378).

• CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation (XSA-379)(bsc#1189376).

• CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: IOMMU page mapping issues on x86 (XSA-378)(bsc#1189373).

• CVE-2021-28699: inadequate grant-v2 status frames array bounds check (XSA-382)(bsc#1189380).

• CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling (bsc#1186429)

• CVE-2021-28690: xen: x86: TSX Async Abort protections not restored after S3 (bsc#1186434)

• CVE-2021-0089: xen: Speculative Code Store Bypass (bsc#1186433)

• CVE-2021-20255: Fixed stack overflow via infinite recursion in eepro100 (bsc#1182654)

• CVE-2021-3592: slirp: invalid pointer initialization may lead to information disclosure (bootp)(bsc#1187369).

• CVE-2021-3594: slirp: invalid pointer initialization may lead to information disclosure (udp)(bsc#1187378).

• CVE-2021-3595: slirp: invalid pointer initialization may lead to information disclosure (tftp)(bsc#1187376).

• CVE-2021-3308: Fixed IRQ vector leak on x86 (XSA-360)(bsc#1181254).

• Prevent superpage allocation in the LAPIC and ACPI_INFO range (bsc#1189882).

This update for xen fixes the following issues:

• CVE-2021-3594: slirp: invalid pointer initialization may lead to information disclosure (udp)(bsc#1187378).

• CVE-2021-3595: slirp: invalid pointer initialization may lead to information disclosure (tftp)(bsc#1187376).

• CVE-2021-28698: long running loops in grant table handling (XSA-380)(bsc#1189378).

• CVE-2021-28699: inadequate grant-v2 status frames array bounds check (XSA-382)(bsc#1189380).

• CVE-2021-20255: Fixed stack overflow via infinite recursion in eepro100 (bsc#1182654)

• CVE-2021-28690: xen: x86: TSX Async Abort protections not restored after S3 (bsc#1186434)

• CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling (bsc#1186429)

• CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: IOMMU page mapping issues on x86 (XSA-378)(bsc#1189373).

• CVE-2021-0089: xen: Speculative Code Store Bypass (bsc#1186433)

• CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation (XSA-379)(bsc#1189376).

• CVE-2021-3592: slirp: invalid pointer initialization may lead to information disclosure (bootp)(bsc#1187369).

• Prevent superpage allocation in the LAPIC and ACPI_INFO range (bsc#1189882).

This update for xen fixes the following issues:

• CVE-2021-28701: Fixed race condition in XENMAPSPACE_grant_table handling (XSA-384) (bsc#1189632).

• CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: Fixed IOMMU page mapping issues on x86 (XSA-378)(bsc#1189373).

• CVE-2021-28697: Fixed grant table v2 status pages that may remain accessible after de-allocation (XSA-379)(bsc#1189376).

• CVE-2021-28698: Fixed long running loops in grant table handling (XSA-380)(bsc#1189378).

• CVE-2021-20255: Fixed eepro100 stack overflow via infinite recursion (bsc#1182654).

• CVE-2021-3592: Fixed invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187369).

• CVE-2021-3594: Fixed invalid pointer initialization may lead to information disclosure (udp) (bsc#1187378).

• CVE-2021-3595: Fixed invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187376).

• CVE-2021-28692: Fixed inappropriate x86 IOMMU timeout detection / handling (XSA-373)(bsc#1186429).

• CVE-2021-0089: Fixed Speculative Code Store Bypass (XSA-375)(bsc#1186433).

• CVE-2021-28690: Fixed x86 TSX Async Abort protections not restored after S3 (XSA-377)(bsc#1186434).

• Prevent superpage allocation in the LAPIC and ACPI_INFO range (bsc#1189882).

This update for libslirp fixes the following issues:

• CVE-2021-3592: Fixed invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364).
• CVE-2021-3594: Fixed invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367).
• CVE-2021-3595: Fixed invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366).
• Fix a dhcp regression [bsc#1198773]

This update for libslirp fixes the following issues:

• CVE-2021-3592: Fixed invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364).
• CVE-2021-3594: Fixed invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367).
• CVE-2021-3595: Fixed invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366).
• Fix a dhcp regression [bsc#1198773]

Qiuhao Li discovered that libslirp incorrectly handled certain header data lengths. An attacker inside a guest could possibly use this issue to leak sensitive information from the host. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2020-29129, CVE-2020-29130)

It was discovered that libslirp incorrectly handled certain udp packets. An attacker inside a guest could possibly use this issue to leak sensitive information from the host. (CVE-2021-3592, CVE-2021-3593, CVE-2021-3594, CVE-2021-3595)

Lei Sun discovered that QEMU incorrectly handled certain MMIO operations. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-15469)

Wenxiang Qian discovered that QEMU incorrectly handled certain ATAPI commands. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 21.04. (CVE-2020-29443)

Cheolwoo Myung discovered that QEMU incorrectly handled SCSI device emulation. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-35504, CVE-2020-35505, CVE-2021-3392)

Alex Xu discovered that QEMU incorrectly handled the virtio-fs shared file system daemon. An attacker inside the guest could possibly use this issue to read and write to host devices. This issue only affected Ubuntu 20.10. (CVE-2020-35517)

It was discovered that QEMU incorrectly handled ARM Generic Interrupt Controller emulation. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-20221)

Alexander Bulekov, Cheolwoo Myung, Sergej Schumilo, Cornelius Aschermann, and Simon Werner discovered that QEMU incorrectly handled e1000 device emulation. An attacker inside the guest could possibly use this issue to cause QEMU to hang, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-20257)

It was discovered that QEMU incorrectly handled SDHCI controller emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, when QEMU is used in combination with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2021-3409)

It was discovered that QEMU incorrectly handled certain NIC emulation devices. An attacker inside the guest could possibly use this issue to cause QEMU to hang or crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-3416)

Remy Noel discovered that QEMU incorrectly handled the USB redirector device. An attacker inside the guest could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. (CVE-2021-3527)

It was discovered that QEMU incorrectly handled the virtio vhost-user GPU device. An attacker inside the guest could possibly use this issue to cause QEMU to consume resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3544)

It was discovered that QEMU incorrectly handled the virtio vhost-user GPU device. An attacker inside the guest could possibly use this issue to obtain sensitive host information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3545)

It was discovered that QEMU incorrectly handled the virtio vhost-user GPU device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, when QEMU is used in combination with libvirt, attackers would be isolated by the libvirt AppArmor profile. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3546)

It was discovered that QEMU incorrectly handled the PVRDMA device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. In the default installation, when QEMU is used in combination with libvirt, attackers would be isolated by the libvirt AppArmor profile. This issue only affected Ubuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-3582,…