Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

openSUSE: 2023:4056-1 Important: Buffer Overflow in QEMU - DoS Risk

opensuse
Calendar Grey October 12, 2023
Scroller Opensuse
The latest qemu patch for openSUSE fixes severe buffer overflow and DoS vulnerabilities. Make sure to upgrade as soon as possible.
This update for qemu fixes the following issues: CVE-2023-3180: Fixed a buffer overflow in the virtio-crypto device (bsc#1213925).

Description

This update for qemu fixes the following issues:

* CVE-2023-3180: Fixed a buffer overflow in the virtio-crypto device

(bsc#1213925).

* CVE-2021-3750: Fixed a DMA reentrancy in the USB EHCI device that could lead

to use-after-free (bsc#1190011).

* CVE-2021-3638: Fixed a buffer overflow in the ati-vga device (bsc#1188609).

* CVE-2023-3354: Fixed an issue when performing a TLS handshake that could

lead to remote denial of service via VNC connection (bsc#1212850).

* CVE-2023-0330: Fixed a DMA reentrancy issue in the lsi53c895a device that

could lead to a stack overflow (bsc#1207205).

Non-security fixes:

* Fixed a potential build issue in the librm subcomponent (bsc#1215311).

* Fixed a potential crash during VM migration (bsc#1213663).

* Fixed potential issues during installation on a Xen host (bsc#1179993,

bsc#1181740).

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow security fix important update openSUSE qemu

Patch

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* openSUSE Leap 15.4

zypper in -t patch SUSE-2023-4056=1 openSUSE-SLE-15.4-2023-4056=1

* SUSE Linux Enterprise Micro for Rancher 5.3

zypper in -t patch SUSE-SLE-Micro-5.3-2023-4056=1

* SUSE Linux Enterprise Micro 5.3

zypper in -t patch SUSE-SLE-Micro-5.3-2023-4056=1

* SUSE Linux Enterprise Micro for Rancher 5.4

zypper in -t patch SUSE-SLE-Micro-5.4-2023-4056=1

* SUSE Linux Enterprise Micro 5.4

zypper in -t patch SUSE-SLE-Micro-5.4-2023-4056=1

* Basesystem Module 15-SP4

zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4056=1

* Server Applications Module 15-SP4

zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2023-4056=1

Package List

* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)

* qemu-block-nfs-debuginfo-6.2.0-150400.37.23.1

* qemu-accel-tcg-x86-6.2.0-150400.37.23.1

* qemu-hw-display-virtio-gpu-6.2.0-150400.37.23.1

* qemu-ksm-6.2.0-150400.37.23.1

* qemu-hw-usb-host-debuginfo-6.2.0-150400.37.23.1

* qemu-hw-display-qxl-debuginfo-6.2.0-150400.37.23.1

* qemu-audio-alsa-6.2.0-150400.37.23.1

* qemu-ivshmem-tools-6.2.0-150400.37.23.1

* qemu-ui-gtk-6.2.0-150400.37.23.1

* qemu-ppc-6.2.0-150400.37.23.1

* qemu-audio-oss-debuginfo-6.2.0-150400.37.23.1

* qemu-block-iscsi-debuginfo-6.2.0-150400.37.23.1

* qemu-audio-alsa-debuginfo-6.2.0-150400.37.23.1

* qemu-linux-user-6.2.0-150400.37.23.1

* qemu-s390x-debuginfo-6.2.0-150400.37.23.1

* qemu-hw-s390x-virtio-gpu-ccw-6.2.0-150400.37.23.1

* qemu-block-iscsi-6.2.0-150400.37.23.1

* qemu-block-gluster-6.2.0-150400.37.23.1

* qemu-block-dmg-debuginfo-6.2.0-150400.37.23.1

* qemu-arm-6.2.0-150400.37.23.1

* qemu-debugsource-6.2.0-150400.37.23.1

* qemu-x86-6.2.0-150400.37.23.1

*...

Read the Full Advisory

References

* #1179993

* #1181740

* #1188609

* #1190011

* #1207205

* #1212850

* #1213663

* #1213925

* #1215311

## References:

* https://www.suse.com/security/cve/CVE-2021-3638.html

* https://www.suse.com/security/cve/CVE-2021-3750.html

* https://www.suse.com/security/cve/CVE-2023-0330.html

* https://www.suse.com/security/cve/CVE-2023-3180.html

* https://www.suse.com/security/cve/CVE-2023-3354.html

* https://bugzilla.suse.com/show_bug.cgi?id=1179993

* https://bugzilla.suse.com/show_bug.cgi?id=1181740

* https://bugzilla.suse.com/show_bug.cgi?id=1188609

* https://bugzilla.suse.com/show_bug.cgi?id=1190011

* https://bugzilla.suse.com/show_bug.cgi?id=1207205

* https://bugzilla.suse.com/show_bug.cgi?id=1212850

* https://bugzilla.suse.com/show_bug.cgi?id=1213663

* https://bugzilla.suse.com/show_bug.cgi?id=1213925

* https://bugzilla.suse.com/show_bug.cgi?id=1215311

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2023:4056-1
Rating: important

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow security fix important update openSUSE qemu

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.