Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

openSUSE Leap 15.2: 2021:0363-1 Critical: QEMU Access Fix

opensuse
Calendar Grey March 1, 2021
Dist Opensuse Esm H88
A significant openSUSE qemu upgrade addresses four critical vulnerabilities, involving potential privilege escalation and buffer overflow issues.
An update that solves four vulnerabilities and has four fixes is now available

Description

This update for qemu fixes the following issues:

- Fixed potential privilege escalation in virtfs (CVE-2021-20181

bsc#1182137)

- Fixed out-of-bound access in iscsi (CVE-2020-11947 bsc#1180523)

- Fixed out-of-bound access in vmxnet3 emulation (CVE-2021-20203

bsc#1181639)

- Fixed out-of-bound access in ARM interrupt handling (CVE-2021-20221

bsc#1181933)

- Fixed vfio-pci device on s390 enters error state (bsc#1179717

bsc#1179719)

- Fixed "Failed to try-restart qemu-ga@.service" error while updating the

qemu-guest-agent. (bsc#1178565)

- Apply fixes to qemu scsi passthrough with respect to timeout and error

conditions, including using more correct status codes. Add more qemu

tracing which helped track down these issues (bsc#1178049)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Topics%20covered

Topics Covered

security advisory privilege escalation access issue critical fix important out-of-bounds access openSUSE qemu important security patch qemu access fix

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.2:

zypper in -t patch openSUSE-2021-363=1

Package List

- openSUSE Leap 15.2 (noarch):

qemu-ipxe-1.0.0+-lp152.9.9.2

qemu-microvm-4.2.1-lp152.9.9.2

qemu-seabios-1.12.1+-lp152.9.9.2

qemu-sgabios-8-lp152.9.9.2

qemu-vgabios-1.12.1+-lp152.9.9.2

- openSUSE Leap 15.2 (x86_64):

qemu-4.2.1-lp152.9.9.2

qemu-arm-4.2.1-lp152.9.9.2

qemu-arm-debuginfo-4.2.1-lp152.9.9.2

qemu-audio-alsa-4.2.1-lp152.9.9.2

qemu-audio-alsa-debuginfo-4.2.1-lp152.9.9.2

qemu-audio-pa-4.2.1-lp152.9.9.2

qemu-audio-pa-debuginfo-4.2.1-lp152.9.9.2

qemu-audio-sdl-4.2.1-lp152.9.9.2

qemu-audio-sdl-debuginfo-4.2.1-lp152.9.9.2

qemu-block-curl-4.2.1-lp152.9.9.2

qemu-block-curl-debuginfo-4.2.1-lp152.9.9.2

qemu-block-dmg-4.2.1-lp152.9.9.2

qemu-block-dmg-debuginfo-4.2.1-lp152.9.9.2

qemu-block-gluster-4.2.1-lp152.9.9.2

qemu-block-gluster-debuginfo-4.2.1-lp152.9.9.2

qemu-block-iscsi-4.2.1-lp152.9.9.2

qemu-block-iscsi-debuginfo-4.2.1-lp152.9.9.2

qemu-block-nfs-4.2.1-lp152.9.9.2

qemu-block-nfs-debuginfo-4.2.1-lp152.9.9.2

qemu-block-rbd-4.2.1-lp152.9.9.2

qemu-block-rbd-debuginfo-4.2.1-lp152.9.9.2

qemu-block-ssh-4.2.1-lp152.9...

Read the Full Advisory

References

https://www.suse.com/security/cve/CVE-2020-11947.html

https://www.suse.com/security/cve/CVE-2021-20181.html

https://www.suse.com/security/cve/CVE-2021-20203.html

https://www.suse.com/security/cve/CVE-2021-20221.html

https://bugzilla.suse.com/1178049

https://bugzilla.suse.com/1178565

https://bugzilla.suse.com/1179717

https://bugzilla.suse.com/1179719

https://bugzilla.suse.com/1180523

https://bugzilla.suse.com/1181639

https://bugzilla.suse.com/1181933

https://bugzilla.suse.com/1182137

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2021:0363-1
Rating: important
Affected Products: openSUSE Leap 15.2 ble.

Topics%20covered

Topics Covered

security advisory privilege escalation access issue critical fix important out-of-bounds access openSUSE qemu important security patch qemu access fix

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here