CVE-2021-3929

A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.

A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.(CVE-2021-3929)

A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.

These are all security issues fixed in the qemu-6.2.0-44.1 package on the GA media of openSUSE Tumbleweed.

This update for qemu fixes the following issues:

• bsc#1172033 (CVE-2020-13253)

• bsc#1180207 (CVE-2020-14394)

• bsc#1172382 (CVE-2020-13754)

• bsc#1198038 (CVE-2022-0216)

• bsc#1193880 (CVE-2021-3929)

• bsc#1197653 (CVE-2022-1050)

• bsc#1205808 (CVE-2022-4144), bsc#1198712 (CVE-2022-26354)

• bsc#1175144 (CVE-2020-17380, CVE-2020-25085, CVE-2021-3409), bsc#1185000 (CVE-2021-3507), bsc#1201367, CVE-2022-35414

• About bsc#1175144, see also bsc#1182282 (CVE-2021-3409)

• bsc#1198035, CVE-2021-4206

This update for qemu fixes the following issues:

• CVE-2022-4144: Fixed unsafe address translation can lead to out-of-bounds read in qxl_phys2virt (bsc#1205808).
• CVE-2021-3507: Fixed heap buffer overflow in DMA read data transfers in fdc (bsc#1185000).
• CVE-2020-14394: Fixed infinite loop in xhci_ring_chain_length() (bsc#1180207).
• CVE-2022-0216: Fixed a use-after-free in lsi_do_msgout function in hw/scsi/lsi53c895a.c (bsc#1198038).
• CVE-2022-1050: Fixed a use-after-free issue in pvrdma_exec_cmd() in pvrdma (bsc#1197653).
• CVE-2021-3929: Fixed a DMA reentrancy issue leads to use-after-free in nvme (bsc#1193880).

The following non-security bugs were fixed:

• Fix bsc#1202364.

This update for qemu fixes the following issues:

• CVE-2022-0216: Fixed a use-after-free in lsi_do_msgout() in hw/scsi/lsi53c895a.c (bsc#1198038).
• CVE-2021-3929: Fixed use-after-free in nvme, caused by DMA reentrancy issue (bsc#1193880).
• CVE-2021-4207: Fixed heap buffer overflow caused by double fetch in qxl_cursor() (bsc#1198037).
• CVE-2021-4206: Fixed integer overflow in cursor_alloc() (bsc#1198035).
• Amend .changes file: avoid declaring a still unfixed CVE, as fixed (bsc#1187529)
• Fix the build breaks caused by binutils update (bsc#1192463, bsc#1193621)

This update for qemu fixes the following issues:

• CVE-2022-26354: Fixed a memory leak due to a missing virtqueue detach on error. (bsc#1198712)
• CVE-2021-3929: Fixed an use-after-free in nvme DMA reentrancy issue. (bsc#1193880)
• CVE-2023-0330: Fixed a stack overflow due to a DMA reentrancy issue. (bsc#1207205)
• CVE-2020-13754: Fixed a DoS due to an OOB access during mmio operations. (bsc#1172382)
• CVE-2023-3354: Fixed a remote unauthenticated DoS due to an improper I/O watch removal in VNC TLS handshake. (bsc#1212850)
• CVE-2023-3180: Fixed a heap buffer overflow in virtio_crypto_sym_op_helper(). (bsc#1213925)
• CVE-2021-3638: Fixed an out-of-bounds write due to an inconsistent check in ati_2d_blt(). (bsc#1188609)
• CVE-2021-3750: Fixed an use-after-free in DMA reentrancy issue. (bsc#1190011)
• CVE-2023-2861: Fixed improper access control on special files in 9pfs (bsc#1212968).
• CVE-2022-1050: Fixed use-after-free issue in pvrdma_exec_cmd() (bsc#1197653).

The following non-security bug was fixed:

• Prepare for binutils update to 2.41 update (bsc#1215311).

This update for qemu fixes the following issues:

• CVE-2022-26354: Fixed a memory leak due to a missing virtqueue detach on error. (bsc#1198712)
• CVE-2021-3929: Fixed an use-after-free in nvme DMA reentrancy issue. (bsc#1193880)
• CVE-2023-0330: Fixed a stack overflow due to a DMA reentrancy issue. (bsc#1207205)
• CVE-2020-13754: Fixed a DoS due to an OOB access during mmio operations. (bsc#1172382)
• CVE-2023-3354: Fixed a remote unauthenticated DoS due to an improper I/O watch removal in VNC TLS handshake. (bsc#1212850)
• CVE-2023-3180: Fixed a heap buffer overflow in virtio_crypto_sym_op_helper(). (bsc#1213925)
• CVE-2023-2861: Fixed improper access control on special files in 9pfs (bsc#1212968).
• CVE-2022-1050: Fixed use-after-free issue in pvrdma_exec_cmd() (bsc#1197653).
• CVE-2021-3750: Fixed DMA reentrancy issue leads to use-after-free in hcd-ehci (bsc#1190011).

The following non-security bug was fixed:

• Prepare for binutils update to 2.41 update (bsc#1215311).

Alexander Bulekov discovered that QEMU incorrectly handled floppy disk emulation. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly leak sensitive information. (CVE-2021-3507)

It was discovered that QEMU incorrectly handled NVME controller emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2021-3929)

It was discovered that QEMU incorrectly handled QXL display device emulation. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-4206, CVE-2021-4207)

Jietao Xiao, Jinku Li, Wenbo Shen, and Nanzi Yang discovered that QEMU incorrectly handled the virtiofsd shared file system daemon. An attacker inside the guest could use this issue to create files with incorrect ownership, possibly leading to privilege escalation. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-0358)

It was discovered that QEMU incorrectly handled virtio-net devices. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-26353)

It was discovered that QEMU incorrectly handled vhost-vsock devices. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-26354)