CVE-2024-4467

A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a json:{} value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a json:{} value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.(CVE-2024-4467)

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write (CVE-2024-4467)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a json:{} value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

• qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write (CVE-2024-4467)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write (CVE-2024-4467)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a json:{} value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.

A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a json:{} value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file.

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU. (CVE-2023-1544) A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. (CVE-2023-3019) A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the inflate_buffer function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service. (CVE-2023-3255) A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot. (CVE-2023-5088) A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a malicious authenticated VNC client to crash QEMU and trigger a denial of service. (CVE-2023-6683) A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables allocated on the stack. Specifically, the out_sg variable could be used to read a part of process memory and send it to the wire, causing an information leak. (CVE-2023-6693) QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately. (CVE-2023-42467) QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len. (CVE-2024-24474) An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF implementations. (CVE-2024-26327) An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled. (CVE-2024-26328) A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to crash the QEMU process on the host, resulting in a denial of service or allow arbitrary code execution within the context of the QEMU process on the host. (CVE-2024-3446) A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both s->data_count and the size of s->fifo_buffer are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. (CVE-2024-3447) A flaw…

These are all security issues fixed in the qemu-9.1.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for qemu fixes the following issues:

• CVE-2023-2861: Fixed improper access control on special files via 9p protocol (bsc#1212968)
• CVE-2024-4467: Fixed denial of service and file read/write via qemu-img info command (bsc#1227322)

Other fixes:

• Fixed qemu build compilation with binutils 2.41 upgrade (bsc#1215311)

This update for qemu fixes the following issues:

• CVE-2024-4467: Fixed denial of service and file read/write via qemu-img info command (bsc#1227322)

• CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure (bsc#1229007)

  • nbd/server: Close stray clients at server-stop
  • nbd/server: Drop non-negotiating clients
  • nbd/server: Cap default max-connections to 100
  • nbd/server: Plumb in new args to nbd_client_add()
  • nbd: Minor style and typo fixes

• Update qemu to version 8.2.6

This update for qemu fixes the following issues:

• CVE-2024-4467: Fixed denial of service and file read/write via qemu-img info command (bsc#1227322)

This update for qemu fixes the following issues:

• CVE-2024-4467: Fixed denial of service and file read/write via qemu-img info command (bsc#1227322)

This update for qemu fixes the following issues:

• Fix bsc#1221812:

  • block: Reschedule query-block during qcow2 invalidation (bsc#1221812)

• Fix bsc#1229007, CVE-2024-7409:

  • nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007)
  • nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007)
  • nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007)
  • nbd/server: Plumb in new args to nbd_client_add() (bsc#1229007, CVE-2024-7409)
  • nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409)

• Update to version 8.2.6:

  Full backport lists (from the various releases) here: https://lore.kernel.org/qemu-devel/[email protected]/

  Some of the upstream backports are: hw/nvme: fix number of PIDs for FDP RUH update sphinx/qapidoc: Fix to generate doc for explicit, unboxed arguments char-stdio: Restore blocking mode of stdout on exit virtio: remove virtio_tswap16s() call in vring_packed_event_read() virtio-pci: Fix the failure process in kvm_virtio_pci_vector_use_one() block: Parse filenames only when explicitly requested iotests/270: Don't store data-file with json: prefix in image iotests/244: Don't store data-file with protocol in image qcow2: Don't open data_file with BDRV_O_NO_IO (bsc#1227322, CVE-2024-4467) target/arm: Fix FJCVTZS vs flush-to-zero target/arm: Fix VCMLA Dd, Dn, Dm[idx] i386/cpu: fixup number of addressable IDs for processor cores in the physical package tests: Update our CI to use CentOS Stream 9 instead of 8 migration: Fix file migration with fdset tcg/loongarch64: Fix tcg_out_movi vs some pcrel pointers target/sparc: use signed denominator in sdiv helper linux-user: Make TARGET_NR_setgroups affect only the current thread accel/tcg: Fix typo causing tb->page_addr[1] to not be recorded stdvga: fix screen blanking hw/audio/virtio-snd: Always use little endian audio format ui/gtk: Draw guest frame at refresh cycle virtio-net: drop too short packets early target/i386: fix size of EBP writeback in gen_enter()

It was discovered that QEMU incorrectly handled certain virtio devices. A privileged guest attacker could use this issue to cause QEMU to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-3446)

It was discovered that QEMU incorrectly handled SDHCI device emulation. A guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-3447)

It was discovered that QEMU incorrectly handled calculating the checksum of a short-sized fragmented packet. A guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-3567)

It was discovered that the QEMU qemu-img utility incorrectly handled certain crafted image files. An attacker could use this issue to cause QEMU to consume resources, leading to a denial of service, or possibly read and write to an existing external file. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-4467)

It was discovered that QEMU incorrectly handled the RSS feature on virtio-net devices. A privileged guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-6505)

It was discovered that QEMU incorrectly handled the NBD server. An attacker could use this issue to cause QEMU to consume resources, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-7409)

It was discovered that QEMU incorrectly handled certain USB devices. A guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-8354)

It was discovered that the QEMU package incorrectly set up a binfmt_misc registration with the C (Credential) flag. A local attacker could use this with a suid/sgid binary to escalate privileges. This update will no longer run foreign-architecture binaries with suid/sgid with elevated privileges.