Lucene search
AmazonALAS2-2023-2060HistoryMay 25, 2023 - 5:41 p.m.
Low: qemu
2023-05-2517:41:00
alas.aws.amazon.com
17
qemu
e1000 nic
infinite loop
denial of service
cve-2021-20257
amazon linux 2
update
package.
CVSS2
2.1
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:N/A:P
CVSS3
6.5
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
AI Score
7.1
Confidence
High
EPSS
0
Percentile
14.2%
Issue Overview:
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2021-20257)
Affected Packages:
qemu
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update qemu to update your system.
New Packages:
aarch64:
qemu-3.1.0-8.amzn2.0.9.aarch64
qemu-common-3.1.0-8.amzn2.0.9.aarch64
qemu-guest-agent-3.1.0-8.amzn2.0.9.aarch64
qemu-img-3.1.0-8.amzn2.0.9.aarch64
ivshmem-tools-3.1.0-8.amzn2.0.9.aarch64
qemu-block-curl-3.1.0-8.amzn2.0.9.aarch64
qemu-block-dmg-3.1.0-8.amzn2.0.9.aarch64
qemu-block-iscsi-3.1.0-8.amzn2.0.9.aarch64
qemu-block-nfs-3.1.0-8.amzn2.0.9.aarch64
qemu-block-rbd-3.1.0-8.amzn2.0.9.aarch64
qemu-block-ssh-3.1.0-8.amzn2.0.9.aarch64
qemu-audio-alsa-3.1.0-8.amzn2.0.9.aarch64
qemu-audio-oss-3.1.0-8.amzn2.0.9.aarch64
qemu-audio-pa-3.1.0-8.amzn2.0.9.aarch64
qemu-audio-sdl-3.1.0-8.amzn2.0.9.aarch64
qemu-ui-curses-3.1.0-8.amzn2.0.9.aarch64
qemu-ui-gtk-3.1.0-8.amzn2.0.9.aarch64
qemu-ui-sdl-3.1.0-8.amzn2.0.9.aarch64
qemu-kvm-3.1.0-8.amzn2.0.9.aarch64
qemu-kvm-core-3.1.0-8.amzn2.0.9.aarch64
qemu-user-3.1.0-8.amzn2.0.9.aarch64
qemu-user-binfmt-3.1.0-8.amzn2.0.9.aarch64
qemu-user-static-3.1.0-8.amzn2.0.9.aarch64
qemu-system-aarch64-3.1.0-8.amzn2.0.9.aarch64
qemu-system-aarch64-core-3.1.0-8.amzn2.0.9.aarch64
qemu-system-x86-3.1.0-8.amzn2.0.9.aarch64
qemu-system-x86-core-3.1.0-8.amzn2.0.9.aarch64
qemu-debuginfo-3.1.0-8.amzn2.0.9.aarch64
i686:
qemu-3.1.0-8.amzn2.0.9.i686
qemu-common-3.1.0-8.amzn2.0.9.i686
qemu-guest-agent-3.1.0-8.amzn2.0.9.i686
qemu-img-3.1.0-8.amzn2.0.9.i686
ivshmem-tools-3.1.0-8.amzn2.0.9.i686
qemu-block-curl-3.1.0-8.amzn2.0.9.i686
qemu-block-dmg-3.1.0-8.amzn2.0.9.i686
qemu-block-iscsi-3.1.0-8.amzn2.0.9.i686
qemu-block-nfs-3.1.0-8.amzn2.0.9.i686
qemu-block-ssh-3.1.0-8.amzn2.0.9.i686
qemu-audio-alsa-3.1.0-8.amzn2.0.9.i686
qemu-audio-oss-3.1.0-8.amzn2.0.9.i686
qemu-audio-pa-3.1.0-8.amzn2.0.9.i686
qemu-audio-sdl-3.1.0-8.amzn2.0.9.i686
qemu-ui-curses-3.1.0-8.amzn2.0.9.i686
qemu-ui-gtk-3.1.0-8.amzn2.0.9.i686
qemu-ui-sdl-3.1.0-8.amzn2.0.9.i686
qemu-kvm-3.1.0-8.amzn2.0.9.i686
qemu-kvm-core-3.1.0-8.amzn2.0.9.i686
qemu-user-3.1.0-8.amzn2.0.9.i686
qemu-user-binfmt-3.1.0-8.amzn2.0.9.i686
qemu-user-static-3.1.0-8.amzn2.0.9.i686
qemu-system-aarch64-3.1.0-8.amzn2.0.9.i686
qemu-system-aarch64-core-3.1.0-8.amzn2.0.9.i686
qemu-system-x86-3.1.0-8.amzn2.0.9.i686
qemu-system-x86-core-3.1.0-8.amzn2.0.9.i686
qemu-debuginfo-3.1.0-8.amzn2.0.9.i686
src:
qemu-3.1.0-8.amzn2.0.9.src
x86_64:
qemu-3.1.0-8.amzn2.0.9.x86_64
qemu-common-3.1.0-8.amzn2.0.9.x86_64
qemu-guest-agent-3.1.0-8.amzn2.0.9.x86_64
qemu-img-3.1.0-8.amzn2.0.9.x86_64
ivshmem-tools-3.1.0-8.amzn2.0.9.x86_64
qemu-block-curl-3.1.0-8.amzn2.0.9.x86_64
qemu-block-dmg-3.1.0-8.amzn2.0.9.x86_64
qemu-block-iscsi-3.1.0-8.amzn2.0.9.x86_64
qemu-block-nfs-3.1.0-8.amzn2.0.9.x86_64
qemu-block-rbd-3.1.0-8.amzn2.0.9.x86_64
qemu-block-ssh-3.1.0-8.amzn2.0.9.x86_64
qemu-audio-alsa-3.1.0-8.amzn2.0.9.x86_64
qemu-audio-oss-3.1.0-8.amzn2.0.9.x86_64
qemu-audio-pa-3.1.0-8.amzn2.0.9.x86_64
qemu-audio-sdl-3.1.0-8.amzn2.0.9.x86_64
qemu-ui-curses-3.1.0-8.amzn2.0.9.x86_64
qemu-ui-gtk-3.1.0-8.amzn2.0.9.x86_64
qemu-ui-sdl-3.1.0-8.amzn2.0.9.x86_64
qemu-kvm-3.1.0-8.amzn2.0.9.x86_64
qemu-kvm-core-3.1.0-8.amzn2.0.9.x86_64
qemu-user-3.1.0-8.amzn2.0.9.x86_64
qemu-user-binfmt-3.1.0-8.amzn2.0.9.x86_64
qemu-user-static-3.1.0-8.amzn2.0.9.x86_64
qemu-system-aarch64-3.1.0-8.amzn2.0.9.x86_64
qemu-system-aarch64-core-3.1.0-8.amzn2.0.9.x86_64
qemu-system-x86-3.1.0-8.amzn2.0.9.x86_64
qemu-system-x86-core-3.1.0-8.amzn2.0.9.x86_64
qemu-debuginfo-3.1.0-8.amzn2.0.9.x86_64
Additional References
Red Hat: CVE-2021-20257
Mitre: CVE-2021-20257
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 2 | aarch64 | qemu | < 3.1.0-8.amzn2.0.9 | qemu-3.1.0-8.amzn2.0.9.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | qemu-common | < 3.1.0-8.amzn2.0.9 | qemu-common-3.1.0-8.amzn2.0.9.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | qemu-guest-agent | < 3.1.0-8.amzn2.0.9 | qemu-guest-agent-3.1.0-8.amzn2.0.9.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | qemu-img | < 3.1.0-8.amzn2.0.9 | qemu-img-3.1.0-8.amzn2.0.9.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | ivshmem-tools | < 3.1.0-8.amzn2.0.9 | ivshmem-tools-3.1.0-8.amzn2.0.9.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | qemu-block-curl | < 3.1.0-8.amzn2.0.9 | qemu-block-curl-3.1.0-8.amzn2.0.9.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | qemu-block-dmg | < 3.1.0-8.amzn2.0.9 | qemu-block-dmg-3.1.0-8.amzn2.0.9.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | qemu-block-iscsi | < 3.1.0-8.amzn2.0.9 | qemu-block-iscsi-3.1.0-8.amzn2.0.9.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | qemu-block-nfs | < 3.1.0-8.amzn2.0.9 | qemu-block-nfs-3.1.0-8.amzn2.0.9.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | qemu-block-rbd | < 3.1.0-8.amzn2.0.9 | qemu-block-rbd-3.1.0-8.amzn2.0.9.aarch64.rpm |
Related
attackerkb
attackerkb
CVE-2021-20257
2020-12-17 00:00:00
prion
prion
Denial of service
2022-03-16 15:15:00
cvelist
cvelist
CVE-2021-20257
2022-03-16 14:12:26
redhatcve
redhatcve
CVE-2021-20257
2021-02-22 08:16:14
cve
cve
CVE-2021-20257
2022-03-16 15:15:09
osv
osv
CVE-2021-20257
2022-03-16 15:15:09
Low: virt:rhel and virt-devel:rhel security update
2021-12-21 09:11:21
alpinelinux
alpinelinux
CVE-2021-20257
2022-03-16 15:15:09
cbl_mariner
cbl_mariner
CVE-2021-20257 affecting package qemu for versions less than 6.2.0-2
2022-06-03 17:54:21
CVE-2021-20257 affecting package qemu-kvm 4.2.0-38
2022-05-26 19:04:44
nessus
nessus
Amazon Linux 2 : qemu (ALAS-2023-2060)
2023-06-05 00:00:00
SUSE SLES12 Security Update : xen (SUSE-SU-2021:1252-1)
2021-04-20 00:00:00
Oracle Linux 7 : qemu (ELSA-2021-9335)
2021-06-28 00:00:00
nvd
nvd
CVE-2021-20257
2022-03-16 15:15:09
veracode
veracode
Denial Of Service (DoS)
2021-03-17 23:46:25
ubuntucve
ubuntucve
CVE-2021-20257
2021-02-23 00:00:00
debiancve
debiancve
CVE-2021-20257
2022-03-16 15:15:09
citrix
citrix
Citrix Hypervisor Security Update
2021-06-23 11:06:42
rocky
rocky
virt:rhel and virt-devel:rhel security update
2021-12-21 09:11:21
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2021:1252-1)
2021-04-26 00:00:00
SUSE: Security Advisory (SUSE-SU-2021:14702-1)
2021-06-09 00:00:00
SUSE: Security Advisory (SUSE-SU-2021:1251-1)
2021-04-26 00:00:00
oraclelinux
oraclelinux
qemu security update
2021-06-28 00:00:00
virt:ol and virt-devel:rhel security update
2021-12-22 00:00:00
qemu security update
2022-01-04 00:00:00
redhat
redhat
(RHSA-2022:0081) Low: virt:av and virt-devel:av security and bug fix update
2022-01-11 09:12:04
(RHSA-2021:5238) Low: virt:rhel and virt-devel:rhel security update
2021-12-21 09:11:21
almalinux
almalinux
Low: virt:rhel and virt-devel:rhel security update
2021-12-21 09:11:21
debian
debian
[SECURITY] [DLA 2623-1] qemu security update
2021-04-10 21:21:02
[SECURITY] [DLA 3099-1] qemu security update
2022-09-05 03:28:05
suse
suse
Security update for qemu (moderate)
2021-07-14 00:00:00
Security update for qemu (important)
2021-04-23 00:00:00
ubuntu
ubuntu
QEMU vulnerabilities
2021-07-15 00:00:00
gentoo
gentoo
QEMU: Multiple Vulnerabilities
2022-08-14 00:00:00
CVSS2
2.1
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:N/A:P
CVSS3
6.5
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
AI Score
7.1
Confidence
High
EPSS
0
Percentile
14.2%
Related for ALAS2-2023-2060