CVE-2022-4144

An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

	QEMU has two operating modes:

	Full system emulation. In this mode, QEMU emulates a full system (for example a PC),
	including one or several processors and various peripherals. It can be used to launch
	different Operating Systems without rebooting the PC or to debug system code.

	User mode emulation. In this mode, QEMU can launch processes compiled for one CPU on another CPU.
	It can be used to launch the Wine Windows API emulator (https://www.winehq.org) or to ease
	cross-compilation and cross-debugging.

Security Fix(es):

An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.(CVE-2022-4144)

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• QEMU: QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read (CVE-2022-4144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• libvirt kills virtual machine on restart when 2M and 1G hugepages are mounted (BZ#2132176)

• VMs hung on vnc_clipboard_send (BZ#2148504)

An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• QEMU: QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read (CVE-2022-4144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• libvirt kills virtual machine on restart when 2M and 1G hugepages are mounted (BZ#2132176)
• VMs hung on vnc_clipboard_send (BZ#2148504)

An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.

These are all security issues fixed in the qemu-7.1.0-10.1 package on the GA media of openSUSE Tumbleweed.

This update for qemu fixes the following issues:

• CVE-2022-4144: Fixed qxl_phys2virt unsafe address translation that can lead to out-of-bounds read (bsc#1205808).
• CVE-2022-3165: Fixed integer underflow in vnc_client_cut_text_ext() (bsc#1203788).
• CVE-2022-1050: Fixed use-after-free issue in pvrdma_exec_cmd() (bsc#1197653).

Bugfixes:

• Fixed deviation of guest clock (bsc#1206527).
• Fixed broken 'block limits' VPD emulation (bsc#1202364).

This update for qemu fixes the following issues:

• bsc#1172033 (CVE-2020-13253)

• bsc#1180207 (CVE-2020-14394)

• bsc#1172382 (CVE-2020-13754)

• bsc#1198038 (CVE-2022-0216)

• bsc#1193880 (CVE-2021-3929)

• bsc#1197653 (CVE-2022-1050)

• bsc#1205808 (CVE-2022-4144), bsc#1198712 (CVE-2022-26354)

• bsc#1175144 (CVE-2020-17380, CVE-2020-25085, CVE-2021-3409), bsc#1185000 (CVE-2021-3507), bsc#1201367, CVE-2022-35414

• About bsc#1175144, see also bsc#1182282 (CVE-2021-3409)

• bsc#1198035, CVE-2021-4206

This update for qemu fixes the following issues:

• CVE-2022-4144: Fixed unsafe address translation can lead to out-of-bounds read in qxl_phys2virt (bsc#1205808).
• CVE-2021-3507: Fixed heap buffer overflow in DMA read data transfers in fdc (bsc#1185000).
• CVE-2020-14394: Fixed infinite loop in xhci_ring_chain_length() (bsc#1180207).
• CVE-2022-0216: Fixed a use-after-free in lsi_do_msgout function in hw/scsi/lsi53c895a.c (bsc#1198038).
• CVE-2022-1050: Fixed a use-after-free issue in pvrdma_exec_cmd() in pvrdma (bsc#1197653).
• CVE-2021-3929: Fixed a DMA reentrancy issue leads to use-after-free in nvme (bsc#1193880).

The following non-security bugs were fixed:

• Fix bsc#1202364.

This update for qemu fixes the following issues:

• CVE-2022-4144: Fixed unsafe address translation that can lead to out-of-bounds read in qxl_phys2virt (bsc#1205808).

This update for qemu fixes the following issues:

• CVE-2022-4144: Fixed unsafe address translation can lead to out-of-bounds read in qxl_phys2virt (bsc#1205808).
• CVE-2021-3507: Fixed heap buffer overflow in DMA read data transfers in fdc (bsc#1185000).

The following non-security bugs were fixed:

• Fix bsc#1202364.
• Introduce max_hw_iov for use in scsi-generic (bsc#1190425)

It was discovered that QEMU did not properly manage the guest drivers when shared buffers are not allocated. A malicious guest driver could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-1050)

It was discovered that QEMU did not properly check the size of the structure pointed to by the guest physical address pqxl. A malicious guest attacker could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-4144)

It was discovered that QEMU did not properly manage memory in the ACPI Error Record Serialization Table (ERST) device. A malicious guest attacker could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 22.10. (CVE-2022-4172)

It was discovered that QEMU did not properly manage memory when DMA memory writes happen repeatedly in the lsi53c895a device. A malicious guest attacker could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2023-0330)