Mageia: Security Advisory (MGASA-2021-0480)

# SPDX-FileCopyrightText: 2022 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.1.10.2021.0480");
  script_cve_id("CVE-2021-3592", "CVE-2021-3593", "CVE-2021-3594", "CVE-2021-3595");
  script_tag(name:"creation_date", value:"2022-01-28 10:58:44 +0000 (Fri, 28 Jan 2022)");
  script_version("2024-02-02T05:06:09+0000");
  script_tag(name:"last_modification", value:"2024-02-02 05:06:09 +0000 (Fri, 02 Feb 2024)");
  script_tag(name:"cvss_base", value:"2.1");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:L/Au:N/C:P/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2021-06-23 17:06:49 +0000 (Wed, 23 Jun 2021)");

  script_name("Mageia: Security Advisory (MGASA-2021-0480)");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2022 Greenbone AG");
  script_family("Mageia Linux Local Security Checks");
  script_dependencies("gather-package-list.nasl");
  script_mandatory_keys("ssh/login/mageia_linux", "ssh/login/release", re:"ssh/login/release=MAGEIA8");

  script_xref(name:"Advisory-ID", value:"MGASA-2021-0480");
  script_xref(name:"URL", value:"https://advisories.mageia.org/MGASA-2021-0480.html");
  script_xref(name:"URL", value:"https://bugs.mageia.org/show_bug.cgi?id=29219");
  script_xref(name:"URL", value:"https://lists.fedoraproject.org/archives/list/[email protected]/thread/SGPQZFVJCFGDSISFXPCQTTBBD7QZLJKI/");

  script_tag(name:"summary", value:"The remote host is missing an update for the 'libslirp' package(s) announced via the MGASA-2021-0480 advisory.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");

  script_tag(name:"insight", value:"Invalid pointer initialization issues were found in the SLiRP networking
implementation of QEMU.

In the bootp_input() function while processing a udp packet that is smaller
than the size of the 'bootp_t' structure. A malicious guest could use this
flaw to leak 10 bytes of uninitialized heap memory from the host. The
highest threat from this vulnerability is to data confidentiality. This
flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3592)

In the udp6_input() function while processing a udp packet that is smaller
than the size of the 'udphdr' structure. This issue may lead to out-of-bounds
read access or indirect host memory disclosure to the guest. The highest
threat from this vulnerability is to data confidentiality. This flaw affects
libslirp versions prior to 4.6.0. (CVE-2021-3593)

In the udp_input() function while processing a udp packet that is smaller
than the size of the 'udphdr' structure. This issue may lead to out-of-bounds
read access or indirect host memory disclosure to the guest. The highest
threat from this vulnerability is to data confidentiality. This flaw affects
libslirp versions prior to 4.6.0. (CVE-2021-3594)

In the tftp_input() function while processing a udp packet that is smaller
than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds
read access or indirect host memory disclosure to the guest. The highest
threat from this vulnerability is to data confidentiality. This flaw affects
libslirp versions prior to 4.6.0. (CVE-2021-3595)");

  script_tag(name:"affected", value:"'libslirp' package(s) on Mageia 8.");

  script_tag(name:"solution", value:"Please install the updated package(s).");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"package");

  exit(0);
}

include("revisions-lib.inc");
include("pkg-lib-rpm.inc");

release = rpm_get_ssh_release();
if(!release)
  exit(0);

res = "";
report = "";

if(release == "MAGEIA8") {

  if(!isnull(res = isrpmvuln(pkg:"lib64slirp-devel", rpm:"lib64slirp-devel~4.4.0~1.1.mga8", rls:"MAGEIA8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"lib64slirp0", rpm:"lib64slirp0~4.4.0~1.1.mga8", rls:"MAGEIA8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"libslirp", rpm:"libslirp~4.4.0~1.1.mga8", rls:"MAGEIA8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"libslirp-devel", rpm:"libslirp-devel~4.4.0~1.1.mga8", rls:"MAGEIA8"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"libslirp0", rpm:"libslirp0~4.4.0~1.1.mga8", rls:"MAGEIA8"))) {
    report += res;
  }

  if(report != "") {
    security_message(data:report);
  } else if(__pkg_match) {
    exit(99);
  }
  exit(0);
}

exit(0);