CVE-2024-3567

A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.

A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

• QEMU: virtio-net: stack buffer overflow in virtio_net_flush_tx() (CVE-2023-6693)

• qemu-kvm: net: assertion failure in update_sctp_checksum() (CVE-2024-3567)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.

These are all security issues fixed in the qemu-8.2.2-2.1 package on the GA media of openSUSE Tumbleweed.

This update for qemu fixes the following issues:

• Update to version 8.2.5:

  • target/loongarch: fix a wrong print in cpu dump
  • ui/sdl2: Allow host to power down screen
  • target/i386: fix SSE and SSE2 feature check
  • target/i386: fix xsave.flat from kvm-unit-tests
  • disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs
  • target/riscv/kvm.c: Fix the hart bit setting of AIA
  • target/riscv: rvzicbo: Fixup CBO extension register calculation
  • target/riscv: do not set mtval2 for non guest-page faults
  • target/riscv: prioritize pmp errors in raise_mmu_exception()
  • target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions
  • target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w
  • target/riscv: rvv: Check single width operator for vector fp widen instructions
  • target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions
  • target/riscv/cpu.c: fix Zvkb extension config
  • target/riscv: Fix the element agnostic function problem
  • target/riscv/kvm: tolerate KVM disable ext errors
  • hw/intc/riscv_aplic: APLICs should add child earlier than realize
  • iotests: test NBD+TLS+iothread
  • qio: Inherit follow_coroutine_ctx across TLS
  • target/arm: Disable SVE extensions when SVE is disabled
  • hw/intc/arm_gic: Fix handling of NS view of GICC_APR<n>
  • hvf: arm: Fix encodings for ID_AA64PFR1_EL1 and debug System registers
  • gitlab: use 'setarch -R' to workaround tsan bug
  • gitlab: use $MAKE instead of 'make'
  • dockerfiles: add 'MAKE' env variable to remaining containers
  • gitlab: Update msys2-64bit runner tags
  • target/i386: no single-step exception after MOV or POP SS

• Update to version 8.2.4.

  • target/sh4: Fix SUBV opcode
  • target/sh4: Fix ADDV opcode
  • hw/arm/npcm7xx: Store derivative OTP fuse key in little endian
  • hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields
  • hw/ufs: Fix buffer overflow bug
  • tests/avocado: update sunxi kernel from armbian to 6.6.16
  • target/loongarch/cpu.c: typo fix: expection
  • backends/cryptodev-builtin: Fix local_error leaks
  • nbd/server: Mark negotiation functions as coroutine_fn
  • nbd/server: do not poll within a coroutine context
  • linux-user: do_setsockopt: fix SOL_ALG.ALG_SET_KEY
  • target/riscv/kvm: change timer regs size to u64
  • target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64
  • target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32

• Update to version 8.2.3.

  • Update version for 8.2.3 release
  • ppc/spapr: Initialize max_cpus limit to SPAPR_IRQ_NR_IPIS.
  • ppc/spapr: Introduce SPAPR_IRQ_NR_IPIS to refer IRQ range for CPU IPIs.
  • hw/pci-host/ppc440_pcix: Do not expose a bridge device on PCI bus
  • hw/isa/vt82c686: Keep track of PIRQ/PINT pins separately
  • virtio-pci: fix use of a released vector
  • linux-user/x86_64: Handle the vsyscall page in open_self_maps_{2,4}
  • hw/audio/virtio-snd: Remove unused assignment
  • hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()
  • hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set
  • hw/net/lan9118: Fix overflow in MIL TX FIFO
  • hw/net/lan9118: Replace magic '2048' value by MIL_TXFIFO_SIZE definition
  • backends/cryptodev: Do not abort for invalid session ID
  • hw/misc/applesmc: Fix memory leak in reset() handler
  • hw/block/nand: Fix out-of-bound access in NAND block buffer
  • hw/block/nand: Have blk_load() take unsigned offset and return boolean
  • hw/block/nand: Factor nand_load_iolen() method out
  • qemu-options: Fix CXL Fixed Memory Window interleave-granularity typo
  • hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs
  • hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs
  • hw/display/virtio-gpu: Protect from DMA re-entrancy bugs
  • mirror: Don't call job_pause_point() under graph lock (bsc#1224179)

• Backports and bugfixes:

  • hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum() (bsc#1222841, CVE-2024-3567) *…

It was discovered that QEMU incorrectly handled certain virtio devices. A privileged guest attacker could use this issue to cause QEMU to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-3446)

It was discovered that QEMU incorrectly handled SDHCI device emulation. A guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-3447)

It was discovered that QEMU incorrectly handled calculating the checksum of a short-sized fragmented packet. A guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-3567)

It was discovered that the QEMU qemu-img utility incorrectly handled certain crafted image files. An attacker could use this issue to cause QEMU to consume resources, leading to a denial of service, or possibly read and write to an existing external file. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-4467)

It was discovered that QEMU incorrectly handled the RSS feature on virtio-net devices. A privileged guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-6505)

It was discovered that QEMU incorrectly handled the NBD server. An attacker could use this issue to cause QEMU to consume resources, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-7409)

It was discovered that QEMU incorrectly handled certain USB devices. A guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-8354)

It was discovered that the QEMU package incorrectly set up a binfmt_misc registration with the C (Credential) flag. A local attacker could use this with a suid/sgid binary to escalate privileges. This update will no longer run foreign-architecture binaries with suid/sgid with elevated privileges.