CVE-2021-3748

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2021-3748)

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

The following packages have been upgraded to a later upstream version: qemu-kvm (6.2.0), libvirt (8.0.0), libvirt-python (8.0.0), perl-Sys-Virt (8.0.0), seabios (1.15.0), libtpms (0.9.1). (BZ#1997410, BZ#2012802, BZ#2012806, BZ#2012813, BZ#2018392, BZ#2027716, BZ#2029355)

Security Fix(es):

• QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu (CVE-2021-3748)

• ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of bytes_in_use value in MFT records (CVE-2021-33285)

• ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string (CVE-2021-33286)

• ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes (CVE-2021-33287)

• ntfs-3g: Heap buffer overflow triggered by a specially crafted MFT section (CVE-2021-33289)

• ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname (CVE-2021-35266)

• ntfs-3g: Stack buffer overflow triggered when correcting differences between MFT and MFTMirror sections (CVE-2021-35267)

• ntfs-3g: Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode (CVE-2021-35268)

• ntfs-3g: Heap buffer overflow in ntfs_attr_setup_flag() triggered by a specially crafted NTFS attribute from MFT (CVE-2021-35269)

• ntfs-3g: NULL pointer dereference in ntfs_extent_inode_open() (CVE-2021-39251)

• ntfs-3g: Out-of-bounds read in ntfs_ie_lookup() (CVE-2021-39252)

• ntfs-3g: Out-of-bounds read in ntfs_runlists_merge_i() (CVE-2021-39253)

• ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize() (CVE-2021-39254)

• ntfs-3g: Out-of-bounds read ntfs_attr_find_in_attrdef() triggered by an invalid attribute (CVE-2021-39255)

• ntfs-3g: Heap buffer overflow in ntfs_inode_lookup_by_name() (CVE-2021-39256)

• ntfs-3g: Endless recursion from ntfs_attr_pwrite() triggered by an unallocated bitmap (CVE-2021-39257)

• ntfs-3g: Out-of-bounds reads in ntfs_attr_find() and ntfs_external_attr_find() (CVE-2021-39258)

• ntfs-3g: Out-of-bounds access in ntfs_inode_lookup_by_name() caused by an unsanitized attribute length (CVE-2021-39259)

• ntfs-3g: Out-of-bounds access in ntfs_inode_sync_standard_information() (CVE-2021-39260)

• ntfs-3g: Heap buffer overflow in ntfs_compressed_pwrite() (CVE-2021-39261)

• ntfs-3g: Out-of-bounds access in ntfs_decompress() (CVE-2021-39262)

• ntfs-3g: Heap buffer overflow in ntfs_get_attribute_value() caused by an unsanitized attribute (CVE-2021-39263)

• libnbd: nbdcopy: missing error handling may create corrupted destination image (CVE-2022-0485)

• hivex: stack overflow due to recursive call of _get_children() (CVE-2021-3622)

• nbdkit: NBD_OPT_STRUCTURED_REPLY injection on STARTTLS (CVE-2021-3716)

• libvirt: segmentation fault during VM shutdown can lead to vdsm hang (CVE-2021-3975)

• QEMU: NULL pointer dereference in mirror_wait_on_conflicts() in block/mirror.c (CVE-2021-4145)

• QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c (CVE-2021-4158)

• QEMU: block: fdc: null pointer dereference may lead to guest crash (CVE-2021-20196)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

The following packages have been upgraded to a later upstream version: qemu-kvm (6.2.0), libvirt (8.0.0), libvirt-python (8.0.0), perl-Sys-Virt (8.0.0), seabios (1.15.0), libtpms (0.9.1). (BZ#1997410, BZ#2012802, BZ#2012806, BZ#2012813, BZ#2018392, BZ#2027716, BZ#2029355)

Security Fix(es):

• QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu (CVE-2021-3748)

• ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of bytes_in_use value in MFT records (CVE-2021-33285)

• ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string (CVE-2021-33286)

• ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes (CVE-2021-33287)

• ntfs-3g: Heap buffer overflow triggered by a specially crafted MFT section (CVE-2021-33289)

• ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname (CVE-2021-35266)

• ntfs-3g: Stack buffer overflow triggered when correcting differences between MFT and MFTMirror sections (CVE-2021-35267)

• ntfs-3g: Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode (CVE-2021-35268)

• ntfs-3g: Heap buffer overflow in ntfs_attr_setup_flag() triggered by a specially crafted NTFS attribute from MFT (CVE-2021-35269)

• ntfs-3g: NULL pointer dereference in ntfs_extent_inode_open() (CVE-2021-39251)

• ntfs-3g: Out-of-bounds read in ntfs_ie_lookup() (CVE-2021-39252)

• ntfs-3g: Out-of-bounds read in ntfs_runlists_merge_i() (CVE-2021-39253)

• ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize() (CVE-2021-39254)

• ntfs-3g: Out-of-bounds read ntfs_attr_find_in_attrdef() triggered by an invalid attribute (CVE-2021-39255)

• ntfs-3g: Heap buffer overflow in ntfs_inode_lookup_by_name() (CVE-2021-39256)

• ntfs-3g: Endless recursion from ntfs_attr_pwrite() triggered by an unallocated bitmap (CVE-2021-39257)

• ntfs-3g: Out-of-bounds reads in ntfs_attr_find() and ntfs_external_attr_find() (CVE-2021-39258)

• ntfs-3g: Out-of-bounds access in ntfs_inode_lookup_by_name() caused by an unsanitized attribute length (CVE-2021-39259)

• ntfs-3g: Out-of-bounds access in ntfs_inode_sync_standard_information() (CVE-2021-39260)

• ntfs-3g: Heap buffer overflow in ntfs_compressed_pwrite() (CVE-2021-39261)

• ntfs-3g: Out-of-bounds access in ntfs_decompress() (CVE-2021-39262)

• ntfs-3g: Heap buffer overflow in ntfs_get_attribute_value() caused by an unsanitized attribute (CVE-2021-39263)

• libnbd: nbdcopy: missing error handling may create corrupted destination image (CVE-2022-0485)

• hivex: stack overflow due to recursive call of _get_children() (CVE-2021-3622)

• nbdkit: NBD_OPT_STRUCTURED_REPLY injection on STARTTLS (CVE-2021-3716)

• libvirt: segmentation fault during VM shutdown can lead to vdsm hang (CVE-2021-3975)

• QEMU: NULL pointer dereference in mirror_wait_on_conflicts() in block/mirror.c (CVE-2021-4145)

• QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c (CVE-2021-4158)

• QEMU: block: fdc: null pointer dereference may lead to guest crash (CVE-2021-20196)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)
• CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)

Non-security issues fixed:

• Add transfer length item in block limits page of scsi vpd (bsc#1190425)
• Fix qemu crash while deleting xen-block (bsc#1189234)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)
• CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)

Non-security issues fixed:

• Add transfer length item in block limits page of scsi vpd (bsc#1190425)
• Fix qemu crash while deleting xen-block (bsc#1189234)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)
• CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)

Non-security issues fixed:

• Add transfer length item in block limits page of scsi vpd (bsc#1190425)
• Fix qemu crash while deleting xen-block (bsc#1189234)

This update for qemu fixes the following issues:

Security issues fixed:

• Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
• Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)
• usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
• NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
• NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
• eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
• usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)

Non-security issues fixed:

• Use max host physical address if -cpu max is used (bsc#1188299)

These are all security issues fixed in the qemu-6.1.0-34.1 package on the GA media of openSUSE Tumbleweed.

This update for qemu fixes the following issues:

• CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)
• CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)
• CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)

Non-security issues fixed:

• Add transfer length item in block limits page of scsi vpd (bsc#1190425)
• Fix qemu crash while deleting xen-block (bsc#1189234)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3713: Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702)
• CVE-2021-3748: Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938)

Non-security issues fixed:

• Add transfer length item in block limits page of scsi vpd (bsc#1190425)
• Fix qemu crash while deleting xen-block (bsc#1189234)

This update for qemu fixes the following issues:

Security issues fixed:

• Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)
• Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
• usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
• NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
• NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
• eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
• usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)

This update for qemu fixes the following issues:

Security issues fixed:

• Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
• Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)
• usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
• NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
• NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
• eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
• usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)

Non-security issues fixed:

• Use max host physical address if -cpu max is used (bsc#1188299)

This update for qemu fixes the following issues:

Security issues fixed:

• Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)
• Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
• usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
• NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505) (bsc#1180435, CVE-2020-35506)
• NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
• eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
• usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)

This update for qemu fixes the following issues:

Security issues fixed:

• Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
• Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)

Gaoning Pan discovered that QEMU incorrectly handled the floppy disk emulator. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2021-20196)

Gaoning Pan discovered that the QEMU vmxnet3 NIC emulator incorrectly handled certain values. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2021-20203)

It was discovered that the QEMU vhost-user GPU device contained several security issues. An attacker inside the guest could use these issues to cause QEMU to crash, resulting in a denial of service, leak sensitive information, or possibly execute arbitrary code. This issue only affected Ubuntu 21.10. (CVE-2021-3544, CVE-2021-3545, CVE-2021-3546)

It was discovered that QEMU incorrectly handled bulk transfers from SPICE clients. A remote attacker could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3682)

It was discovered that the QEMU UAS device emulation incorrectly handled certain stream numbers. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 21.10. (CVE-2021-3713)

It was discovered that the QEMU virtio-net device incorrectly handled certain buffer addresses. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-3748)

It was discovered that the QEMU SCSI device emulation incorrectly handled certain MODE SELECT commands. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2021-3930)

It was discovered that the QEMU ACPI logic incorrectly handled certain values. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 21.10. (CVE-2021-4158)

Jietao Xiao, Jinku Li, Wenbo Shen, and Nanzi Yang discovered that the QEMU virtiofsd device incorrectly handled permissions when creating files. An attacker inside the guest could use this issue to create files inside the directory shared by virtiofs with unintended permissions, possibly allowing privilege escalation. This issue only affected Ubuntu 21.10. (CVE-2022-0358)