Lucene search

K
amazon
AmazonALAS2-2021-1671
HistoryJun 16, 2021 - 8:37 p.m.

Medium: qemu

2021-06-1620:37:00
alas.aws.amazon.com
16

6 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

5.9 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.004 Low

EPSS

Percentile

72.0%

Issue Overview:

A heap buffer overflow flaw was found in the iSCSI support of QEMU. This flaw could lead to an out-of-bounds read access and possible information disclosure from the QEMU process memory to a malicious guest. The highest threat from this vulnerability is to data confidentiality. (CVE-2020-11947)

An infinite loop flaw was found in the e1000e NIC emulation code of QEMU. This issue occurs in the e1000e_write_packet_to_guest() routine while processing bogus RX descriptor data transmitted by the guest. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. (CVE-2020-25707)

A reachable assertion vulnerability was found in the USB EHCI emulation code of QEMU. This issue occurs while processing USB requests due to missed handling of DMA memory map failure. This flaw allows a malicious privileged user within the guest to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-25723)

A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service. (CVE-2020-27821)

An out-of-bounds access issue was found in the SLiRP user networking implementation of QEMU. It could occur while processing ARP/NCSI packets, if the packet length was shorter than required to accommodate respective protocol headers and payload. A privileged guest user may use this flaw to potentially leak host information bytes. (CVE-2020-29129)

An out-of-bounds access issue was found in the SLiRP user networking implementation of QEMU. It could occur while processing ARP/NCSI packets, if the packet length was shorter than required to accommodate respective protocol headers and payload. A privileged guest user may use this flaw to potentially leak host information bytes. (CVE-2020-29130)

An out-of-bounds read-access flaw was found in the ATAPI Emulator of QEMU. This issue occurs while processing the ATAPI read command if the logical block address(LBA) is set to an invalid value. A guest user may use this flaw to crash the QEMU process on the host resulting in a denial of service. (CVE-2020-29443)

Affected Packages:

qemu

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update qemu to update your system.

New Packages:

aarch64:  
    qemu-3.1.0-8.amzn2.0.8.aarch64  
    qemu-common-3.1.0-8.amzn2.0.8.aarch64  
    qemu-guest-agent-3.1.0-8.amzn2.0.8.aarch64  
    qemu-img-3.1.0-8.amzn2.0.8.aarch64  
    ivshmem-tools-3.1.0-8.amzn2.0.8.aarch64  
    qemu-block-curl-3.1.0-8.amzn2.0.8.aarch64  
    qemu-block-dmg-3.1.0-8.amzn2.0.8.aarch64  
    qemu-block-iscsi-3.1.0-8.amzn2.0.8.aarch64  
    qemu-block-nfs-3.1.0-8.amzn2.0.8.aarch64  
    qemu-block-rbd-3.1.0-8.amzn2.0.8.aarch64  
    qemu-block-ssh-3.1.0-8.amzn2.0.8.aarch64  
    qemu-audio-alsa-3.1.0-8.amzn2.0.8.aarch64  
    qemu-audio-oss-3.1.0-8.amzn2.0.8.aarch64  
    qemu-audio-pa-3.1.0-8.amzn2.0.8.aarch64  
    qemu-audio-sdl-3.1.0-8.amzn2.0.8.aarch64  
    qemu-ui-curses-3.1.0-8.amzn2.0.8.aarch64  
    qemu-ui-gtk-3.1.0-8.amzn2.0.8.aarch64  
    qemu-ui-sdl-3.1.0-8.amzn2.0.8.aarch64  
    qemu-kvm-3.1.0-8.amzn2.0.8.aarch64  
    qemu-kvm-core-3.1.0-8.amzn2.0.8.aarch64  
    qemu-user-3.1.0-8.amzn2.0.8.aarch64  
    qemu-user-binfmt-3.1.0-8.amzn2.0.8.aarch64  
    qemu-user-static-3.1.0-8.amzn2.0.8.aarch64  
    qemu-system-aarch64-3.1.0-8.amzn2.0.8.aarch64  
    qemu-system-aarch64-core-3.1.0-8.amzn2.0.8.aarch64  
    qemu-system-x86-3.1.0-8.amzn2.0.8.aarch64  
    qemu-system-x86-core-3.1.0-8.amzn2.0.8.aarch64  
    qemu-debuginfo-3.1.0-8.amzn2.0.8.aarch64  
  
i686:  
    qemu-3.1.0-8.amzn2.0.8.i686  
    qemu-common-3.1.0-8.amzn2.0.8.i686  
    qemu-guest-agent-3.1.0-8.amzn2.0.8.i686  
    qemu-img-3.1.0-8.amzn2.0.8.i686  
    ivshmem-tools-3.1.0-8.amzn2.0.8.i686  
    qemu-block-curl-3.1.0-8.amzn2.0.8.i686  
    qemu-block-dmg-3.1.0-8.amzn2.0.8.i686  
    qemu-block-iscsi-3.1.0-8.amzn2.0.8.i686  
    qemu-block-nfs-3.1.0-8.amzn2.0.8.i686  
    qemu-block-ssh-3.1.0-8.amzn2.0.8.i686  
    qemu-audio-alsa-3.1.0-8.amzn2.0.8.i686  
    qemu-audio-oss-3.1.0-8.amzn2.0.8.i686  
    qemu-audio-pa-3.1.0-8.amzn2.0.8.i686  
    qemu-audio-sdl-3.1.0-8.amzn2.0.8.i686  
    qemu-ui-curses-3.1.0-8.amzn2.0.8.i686  
    qemu-ui-gtk-3.1.0-8.amzn2.0.8.i686  
    qemu-ui-sdl-3.1.0-8.amzn2.0.8.i686  
    qemu-kvm-3.1.0-8.amzn2.0.8.i686  
    qemu-kvm-core-3.1.0-8.amzn2.0.8.i686  
    qemu-user-3.1.0-8.amzn2.0.8.i686  
    qemu-user-binfmt-3.1.0-8.amzn2.0.8.i686  
    qemu-user-static-3.1.0-8.amzn2.0.8.i686  
    qemu-system-aarch64-3.1.0-8.amzn2.0.8.i686  
    qemu-system-aarch64-core-3.1.0-8.amzn2.0.8.i686  
    qemu-system-x86-3.1.0-8.amzn2.0.8.i686  
    qemu-system-x86-core-3.1.0-8.amzn2.0.8.i686  
    qemu-debuginfo-3.1.0-8.amzn2.0.8.i686  
  
src:  
    qemu-3.1.0-8.amzn2.0.8.src  
  
x86_64:  
    qemu-3.1.0-8.amzn2.0.8.x86_64  
    qemu-common-3.1.0-8.amzn2.0.8.x86_64  
    qemu-guest-agent-3.1.0-8.amzn2.0.8.x86_64  
    qemu-img-3.1.0-8.amzn2.0.8.x86_64  
    ivshmem-tools-3.1.0-8.amzn2.0.8.x86_64  
    qemu-block-curl-3.1.0-8.amzn2.0.8.x86_64  
    qemu-block-dmg-3.1.0-8.amzn2.0.8.x86_64  
    qemu-block-iscsi-3.1.0-8.amzn2.0.8.x86_64  
    qemu-block-nfs-3.1.0-8.amzn2.0.8.x86_64  
    qemu-block-rbd-3.1.0-8.amzn2.0.8.x86_64  
    qemu-block-ssh-3.1.0-8.amzn2.0.8.x86_64  
    qemu-audio-alsa-3.1.0-8.amzn2.0.8.x86_64  
    qemu-audio-oss-3.1.0-8.amzn2.0.8.x86_64  
    qemu-audio-pa-3.1.0-8.amzn2.0.8.x86_64  
    qemu-audio-sdl-3.1.0-8.amzn2.0.8.x86_64  
    qemu-ui-curses-3.1.0-8.amzn2.0.8.x86_64  
    qemu-ui-gtk-3.1.0-8.amzn2.0.8.x86_64  
    qemu-ui-sdl-3.1.0-8.amzn2.0.8.x86_64  
    qemu-kvm-3.1.0-8.amzn2.0.8.x86_64  
    qemu-kvm-core-3.1.0-8.amzn2.0.8.x86_64  
    qemu-user-3.1.0-8.amzn2.0.8.x86_64  
    qemu-user-binfmt-3.1.0-8.amzn2.0.8.x86_64  
    qemu-user-static-3.1.0-8.amzn2.0.8.x86_64  
    qemu-system-aarch64-3.1.0-8.amzn2.0.8.x86_64  
    qemu-system-aarch64-core-3.1.0-8.amzn2.0.8.x86_64  
    qemu-system-x86-3.1.0-8.amzn2.0.8.x86_64  
    qemu-system-x86-core-3.1.0-8.amzn2.0.8.x86_64  
    qemu-debuginfo-3.1.0-8.amzn2.0.8.x86_64  

Additional References

Red Hat: CVE-2020-11947, CVE-2020-25707, CVE-2020-25723, CVE-2020-27821, CVE-2020-29129, CVE-2020-29130, CVE-2020-29443

Mitre: CVE-2020-11947, CVE-2020-25707, CVE-2020-25723, CVE-2020-27821, CVE-2020-29129, CVE-2020-29130, CVE-2020-29443

Use Vulners API to create your own security tool

API usage cases
  • Network scanning
  • Linux Patch management
  • Threat protection
  • No network audit solution

Ways of integration

Integrate Vulners API

6 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

5.9 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.004 Low

EPSS

Percentile

72.0%

Related for ALAS2-2021-1671