CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
72.7%
Debian LTS Advisory DLA-3362-1 [email protected]
https://www.debian.org/lts/security/ Sylvain Beucler
March 14, 2023 https://wiki.debian.org/LTS
Package : qemu
Version : 1:3.1+dfsg-8+deb10u10
CVE ID : CVE-2020-14394 CVE-2020-29130 CVE-2021-3592 CVE-2021-3593
CVE-2021-3594 CVE-2021-3595 CVE-2022-0216 CVE-2022-1050
Debian Bug : 970937 979677 986795 989993 989994 989995 989996 1014589 1014590
Multiple security issues were discovered in QEMU, a fast processor
emulator, which could result in denial of service, information leak,
or potentially the execution of arbitrary code.
CVE-2020-14394
An infinite loop flaw was found in the USB xHCI controller
emulation of QEMU while computing the length of the Transfer
Request Block (TRB) Ring. This flaw allows a privileged guest user
to hang the QEMU process on the host, resulting in a denial of
service.
CVE-2020-17380/CVE-2021-3409
A heap-based buffer overflow was found in QEMU in the SDHCI device
emulation support. It could occur while doing a multi block SDMA
transfer via the sdhci_sdma_transfer_multi_blocks() routine in
hw/sd/sdhci.c. A guest user or process could use this flaw to
crash the QEMU process on the host, resulting in a denial of
service condition, or potentially execute arbitrary code with
privileges of the QEMU process on the host.
CVE-2020-29130
slirp.c has a buffer over-read because it tries to read a certain
amount of header data even if that exceeds the total packet
length.
CVE-2021-3592
An invalid pointer initialization issue was found in the SLiRP
networking implementation of QEMU. The flaw exists in the
bootp_input() function and could occur while processing a udp
packet that is smaller than the size of the 'bootp_t' structure. A
malicious guest could use this flaw to leak 10 bytes of
uninitialized heap memory from the host.
CVE-2021-3593
An invalid pointer initialization issue was found in the SLiRP
networking implementation of QEMU. The flaw exists in the
udp6_input() function and could occur while processing a udp
packet that is smaller than the size of the 'udphdr'
structure. This issue may lead to out-of-bounds read access or
indirect host memory disclosure to the guest.
CVE-2021-3594
An invalid pointer initialization issue was found
in the SLiRP networking implementation of QEMU. The flaw exists in
the udp_input() function and could occur while processing a udp
packet that is smaller than the size of the 'udphdr'
structure. This issue may lead to out-of-bounds read access or
indirect host memory disclosure to the guest.
CVE-2021-3595
An invalid pointer initialization issue was found in the SLiRP
networking implementation of QEMU. The flaw exists in the
tftp_input() function and could occur while processing a udp
packet that is smaller than the size of the 'tftp_t'
structure. This issue may lead to out-of-bounds read access or
indirect host memory disclosure to the guest.
CVE-2022-0216
A use-after-free vulnerability was found in the LSI53C895A SCSI
Host Bus Adapter emulation of QEMU. The flaw occurs while
processing repeated messages to cancel the current SCSI request
via the lsi_do_msgout function. This flaw allows a malicious
privileged user within the guest to crash the QEMU process on the
host, resulting in a denial of service.
CVE-2022-1050
A flaw was found in the QEMU implementation of VMWare's
paravirtual RDMA device. This flaw allows a crafted guest driver
to execute HW commands when shared buffers are not yet allocated,
potentially leading to a use-after-free condition.
Note: PVRDMA is disabled in buster, but this was fixed
preventively in case this changes in the future.
For Debian 10 buster, these problems have been fixed in version
1:3.1+dfsg-8+deb10u10.
We recommend that you upgrade your qemu packages.
For the detailed security status of qemu please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/qemu
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 10 | arm64 | qemu-user-static | <Â 1:3.1+dfsg-8+deb10u10 | qemu-user-static_1:3.1+dfsg-8+deb10u10_arm64.deb |
Debian | 9 | i386 | qemu-system-sparc | <Â 1:2.8+dfsg-6+deb9u17 | qemu-system-sparc_1:2.8+dfsg-6+deb9u17_i386.deb |
Debian | 11 | amd64 | libslirp0-dbgsym | <Â 4.4.0-1+deb11u2 | libslirp0-dbgsym_4.4.0-1+deb11u2_amd64.deb |
Debian | 9 | i386 | qemu | <Â 1:2.8+dfsg-6+deb9u17 | qemu_1:2.8+dfsg-6+deb9u17_i386.deb |
Debian | 11 | mipsel | libslirp-dev | <Â 4.4.0-1+deb11u2 | libslirp-dev_4.4.0-1+deb11u2_mipsel.deb |
Debian | 9 | armel | qemu-block-extra | <Â 1:2.8+dfsg-6+deb9u17 | qemu-block-extra_1:2.8+dfsg-6+deb9u17_armel.deb |
Debian | 9 | arm64 | qemu-system-sparc | <Â 1:2.8+dfsg-6+deb9u17 | qemu-system-sparc_1:2.8+dfsg-6+deb9u17_arm64.deb |
Debian | 9 | armel | qemu-user-binfmt | <Â 1:2.8+dfsg-6+deb9u17 | qemu-user-binfmt_1:2.8+dfsg-6+deb9u17_armel.deb |
Debian | 9 | armel | qemu-user | <Â 1:2.8+dfsg-6+deb9u17 | qemu-user_1:2.8+dfsg-6+deb9u17_armel.deb |
Debian | 10 | i386 | qemu-utils | <Â 1:3.1+dfsg-8+deb10u10 | qemu-utils_1:3.1+dfsg-8+deb10u10_i386.deb |
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
72.7%