Debian Stretch: DLA-2288-1 High: Qemu Multiple Security Issues

debian lts

July 26, 2020

The following CVE(s) were reported against src:qemu: CVE-2017-9503

Topics Covered

security advisory buffer overflow debian DoS memory leak out-of-bounds access qemu

Summary

CVE-2017-9503

QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2
Host Bus Adapter emulation support, allows local guest OS
privileged users to cause a denial of service (NULL pointer
dereference and QEMU process crash) via vectors involving megasas
command processing.

CVE-2019-12068

In QEMU 1:4.1-1 (1:2.8+dfsg-6+deb9u8), when executing script in
lsi_execute_script(), the LSI scsi adapter emulator advances
's->dsp' index to read next opcode. This can lead to an infinite
loop if the next opcode is empty. Move the existing loop exit
after 10k iterations so that it covers no-op opcodes as well.

CVE-2019-20382

QEMU 4.1.0 has a memory leak in zrle_compress_data in
ui/vnc-enc-zrle.c during a VNC disconnect operation because libz
is misused, resulting in a situation where memory allocated in
deflateInit2 is not freed in deflateEnd.

CVE-2020-1983

A use after free vulnerability in ip_reass() in ip_input.c of