qemu-kvm: pcie: improper validation of NumVFs leads to buffer overflow

A flaw was found in the SR/IOV emulation support of QEMU. The registervfs function in hw/pci/pciesriov.c mishandled the situation where a guest writes NumVFs greater than TotalVFs, leading to a buffer overflow in VF Virtual Function implementations. This flaw allows a malicious guest to crash QEM...

USN-7100-1: Linux kernel vulnerabilities

Supraja Sridhara, Benedict Schlüter, Mark Kuhne, Andrin Bertschi, and Shweta Shinde discovered that the Confidential Computing framework in the Linux kernel for x86 platforms did not properly handle 32-bit emulation on TDX and SEV. An attacker with access to the VMM could use this to cause a deni...

USN-7100-1 linux, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi, linux-xilinx-zynqmp vulnerabilities

Supraja Sridhara, Benedict Schlüter, Mark Kuhne, Andrin Bertschi, and Shweta Shinde discovered that the Confidential Computing framework in the Linux kernel for x86 platforms did not properly handle 32-bit emulation on TDX and SEV. An attacker with access to the VMM could use this to cause a deni...

virtual host shell LSI53C895A SCSI emulator QEMU Privilege Escalation

The vulnerability of the implementation of the virtual host shell LSI53C895A SCSI emulation software for hardware support by QEMU is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary code...

QEMU Guest Agent Service Privilege Escalation

The vulnerability of the Guest Agent Service emulation software for hardware devices based on QEMU is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker to enhance their privileges within the system...

WS-2023-0420

gnark provides a gadget in the standard library to allow optimized checking of the bitwidth of the inputs. The gadget works by constructing a fixed lookup table containing all valid entries, partitioning the input and checking that all parts are inside the lookup table. The range checker gadget d...

QEMU USB EP Get DoS

The vulnerability of the usbepget function hw/net/core.c in the QEMU hardware emulation software is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a attacker to cause a system failure...

Exploit for Out-of-bounds Write in Tenda Ac8_Firmware

CVE-2023-33669 Exploit Exploit for a stack overflow vulnerabi...

SUSE-SU-2024:3744-1 Security update for qemu

This update for qemu fixes the following issues: Security fixes: - CVE-2024-8354: Fixed assertion failure in usbepget bsc1230834 - CVE-2024-8612: Fixed information leak in virtio devices bsc1230915 Update version to 8.2.7: Security fixes: - CVE-2024-7409: Fixed denial of service via improper...

CVE-2024-6519

A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape...

CVE-2024-6519

CVE-2024-6519 affects QEMU’s LSI53C895A SCSI Host Bus Adapter emulation. The vulnerability is a use-after-free in the emulation code, leading to a crash or VM escape. CVSS metrics indicate a local, low-complexity exploit with high impact ( Confidentiality/Integrity/Availability: HIGH; Privileges ...

CVE-2024-41585

DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an attacker to leverage the recvCmd binary to escape from the emulated instance and inject arbitrary commands into the host machine...

CLSA-2024-1727690947 kernel: Fix of 80 CVEs

sch/netem: fix use after free in netemdequeue CVE-2024-46800 - VMCI: Fix use-after-free when removing resource in vmciresourceremove CVE-2024-46738 - drm/amdgpu: Fix out-of-bounds write warning CVE-2024-46725 - drm/amdgpu: Fix out-of-bounds read of dfv17channelnumber CVE-2024-46724 - drm/amdgpu:...

CLSA-2024-1727352561 kernel: Fix of 19 CVEs

tipc: Return non-zero value from tipcudpaddr2str on error CVE-2024-42284 - dev/parport: fix the array out-of-bounds risk CVE-2024-42301 - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs CVE-2024-42285 - scsi: aacraid: Fix double-free on probe failure CVE-2024-46673 - ipv6: prevent...

CVE-2024-31145

The Xen hypervisor contains a vulnerability in the logic establishing x86 IOMMU identity mappings . Flawed error handling can cause Reserved Memory Regions (RMRR) , used for tasks like legacy USB emulation, to remain active and accessible when they should have been removed. This allows respective...

CVE-2024-31145 error handling in x86 IOMMU identity mapping

Certain PCI devices in a system might be assigned Reserved Memory Regions specified via Reserved Memory Region Reporting, "RMRR" for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose of these regions ...

QEMU Synchronization Data Compromise

The vulnerability of the QEMU hardware emulation software is related to synchronization errors. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures...

QEMU Hardware Emulation DoS

The vulnerability of the readerstrecord and writeerstrecord functions in the QEMU hardware emulation software involves copying buffers without checking the input data. Exploiting this vulnerability allows an attacker to cause a service failure...

FreeBSD : FreeBSD -- bhyve(8) out-of-bounds read access via XHCI emulation (1febd09b-7716-11ef-9a62-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1febd09b-7716-11ef-9a62-002590c1f29c advisory. bhyve can be configured to emulate devices on a virtual USB controller XHCI, such as USB tablet devices...

CVE-2024-41721 bhyve(8) out-of-bounds read access via XHCI emulation

An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbitrary write and remote code execution...