Important: qemu-kvm

Issue Overview:

qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread. (CVE-2018-15746)

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the ip_reass() routine while reassembling incoming packets if the first fragment is bigger than the m->m_dat[] buffer. An attacker could use this flaw to crash the QEMU process on the host, resulting in a Denial of Service or potentially executing arbitrary code with privileges of the QEMU process. (CVE-2019-14378)

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU. This issue occurs while processing USB packets from a guest when USBDevice ‘setup_len’ exceeds its ‘data_buf[4096]’ in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host. (CVE-2020-14364)

A use-after-free flaw was found in the SLiRP networking implementation of the QEMU emulator. Specifically, this flaw occurs in the ip_reass() routine while reassembling incoming IP fragments whose combined size is bigger than 65k. This flaw allows an attacker to crash the QEMU process on the host, resulting in a denial of service. (CVE-2020-1983)

Affected Packages:

qemu-kvm

Issue Correction:
Run yum update qemu-kvm to update your system.

New Packages:

src:  
    qemu-kvm-1.5.3-156.24.amzn1.src  
  
x86_64:  
    qemu-kvm-1.5.3-156.24.amzn1.x86_64  
    qemu-kvm-tools-1.5.3-156.24.amzn1.x86_64  
    qemu-kvm-common-1.5.3-156.24.amzn1.x86_64  
    qemu-img-1.5.3-156.24.amzn1.x86_64  
    qemu-kvm-debuginfo-1.5.3-156.24.amzn1.x86_64  

Additional References

Red Hat: CVE-2018-15746, CVE-2019-14378, CVE-2020-14364, CVE-2020-1983

Mitre: CVE-2018-15746, CVE-2019-14378, CVE-2020-14364, CVE-2020-1983