- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3362-1                [email protected]
https://www.debian.org/lts/security/                      Sylvain Beucler
March 14, 2023                                https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : qemu
Version        : 1:3.1+dfsg-8+deb10u10
CVE ID         : CVE-2020-14394 CVE-2020-29130 CVE-2021-3592 CVE-2021-3593 
                 CVE-2021-3594 CVE-2021-3595 CVE-2022-0216 CVE-2022-1050
Debian Bug     : 970937 979677 986795 989993 989994 989995 989996 1014589 1014590

Multiple security issues were discovered in QEMU, a fast processor
emulator, which could result in denial of service, information leak,
or potentially the execution of arbitrary code.

CVE-2020-14394

    An infinite loop flaw was found in the USB xHCI controller
    emulation of QEMU while computing the length of the Transfer
    Request Block (TRB) Ring. This flaw allows a privileged guest user
    to hang the QEMU process on the host, resulting in a denial of
    service.

CVE-2020-17380/CVE-2021-3409

    A heap-based buffer overflow was found in QEMU in the SDHCI device
    emulation support. It could occur while doing a multi block SDMA
    transfer via the sdhci_sdma_transfer_multi_blocks() routine in
    hw/sd/sdhci.c. A guest user or process could use this flaw to
    crash the QEMU process on the host, resulting in a denial of
    service condition, or potentially execute arbitrary code with
    privileges of the QEMU process on the host.

CVE-2020-29130

    slirp.c has a buffer over-read because it tries to read a certain
    amount of header data even if that exceeds the total packet
    length.

CVE-2021-3592

    An invalid pointer initialization issue was found in the SLiRP
    networking implementation of QEMU. The flaw exists in the
    bootp_input() function and could occur while processing a udp
    packet that is smaller than the size of the 'bootp_t' structure. A
    malicious guest could use this flaw to leak 10 bytes of
    uninitialized heap memory from the host.

CVE-2021-3593

    An invalid pointer initialization issue was found in the SLiRP
    networking implementation of QEMU. The flaw exists in the
    udp6_input() function and could occur while processing a udp
    packet that is smaller than the size of the 'udphdr'
    structure. This issue may lead to out-of-bounds read access or
    indirect host memory disclosure to the guest.

CVE-2021-3594

    An invalid pointer initialization issue was found
    in the SLiRP networking implementation of QEMU. The flaw exists in
    the udp_input() function and could occur while processing a udp
    packet that is smaller than the size of the 'udphdr'
    structure. This issue may lead to out-of-bounds read access or
    indirect host memory disclosure to the guest.

CVE-2021-3595

    An invalid pointer initialization issue was found in the SLiRP
    networking implementation of QEMU. The flaw exists in the
    tftp_input() function and could occur while processing a udp
    packet that is smaller than the size of the 'tftp_t'
    structure. This issue may lead to out-of-bounds read access or
    indirect host memory disclosure to the guest.

CVE-2022-0216

    A use-after-free vulnerability was found in the LSI53C895A SCSI
    Host Bus Adapter emulation of QEMU. The flaw occurs while
    processing repeated messages to cancel the current SCSI request
    via the lsi_do_msgout function. This flaw allows a malicious
    privileged user within the guest to crash the QEMU process on the
    host, resulting in a denial of service.

CVE-2022-1050

    A flaw was found in the QEMU implementation of VMWare's
    paravirtual RDMA device. This flaw allows a crafted guest driver
    to execute HW commands when shared buffers are not yet allocated,
    potentially leading to a use-after-free condition.
    Note: PVRDMA is disabled in buster, but this was fixed
    preventively in case this changes in the future.

For Debian 10 buster, these problems have been fixed in version
1:3.1+dfsg-8+deb10u10.

We recommend that you upgrade your qemu packages.

For the detailed security status of qemu please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/qemu

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS