hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL pointer dereference, which allows the attacker to cause a denial of service via a device driver.

According to the versions of the qemu package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does     not prevent ..\ directory traversal on     Windows.(CVE-2020-7211)

  - interface_release_resource in hw/display/qxl.c in QEMU     4.0.0 has a NULL pointer dereference.(CVE-2019-12155)

  - QEMU 3.0.0 has an Integer Overflow because the     qga/commands*.c files do not check the length of the     argument list or the number of environment variables.
    NOTE: This has been disputed as not     exploitable.(CVE-2019-12247)

  - qemu-bridge-helper.c in QEMU 4.0.0 does not ensure that     a network interface name (obtained from bridge.conf or     a --br=bridge option) is limited to the IFNAMSIZ size,     which can lead to an ACL bypass.(CVE-2019-13164)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a     heap-based buffer overflow via a large packet because     it mishandles a case involving the first     fragment.(CVE-2019-14378)

  - An issue was discovered in ide_dma_cb() in     hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest     system can crash the QEMU process in the host system     via a special SCSI_IOCTL_SEND_COMMAND. It hits an     assertion that implies that the size of successful DMA     transfers there must be a multiple of 512 (the size of     a sector). NOTE: a member of the QEMU security team     disputes the significance of this issue because a     'privileged guest user has many ways to cause similar     DoS effect, without triggering this     assert.'(CVE-2019-20175)

  - hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a     NULL pointer dereference, which allows the attacker to     cause a denial of service via a device     driver.(CVE-2019-5008)

  - An OOB heap buffer r/w access issue was found in the     NVM Express Controller emulation in QEMU. It could     occur in nvme_cmb_ops routines in nvme device. A guest     user/process could use this flaw to crash the QEMU     process resulting in DoS or potentially run arbitrary     code with privileges of the QEMU     process.(CVE-2018-16847)

  - hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to     cause a denial of service (NULL pointer dereference or     excessive memory allocation) in create_cq_ring or     create_qp_rings.(CVE-2018-20125)

  - QEMU can have an infinite loop in     hw/rdma/vmw/pvrdma_dev_ring.c because return values are     not checked (and -1 is mishandled).(CVE-2018-20216)

  - The load_multiboot function in hw/i386/multiboot.c in     Quick Emulator (aka QEMU) allows local guest OS users     to execute arbitrary code on the QEMU host via a     mh_load_end_addr value greater than mh_bss_end_addr,     which triggers an out-of-bounds read or write memory     access.(CVE-2018-7550)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Security issues fixed :

  - CVE-2019-14378: Security fix for heap overflow in     ip_reass on big packet input (bsc#1143794).

  - CVE-2019-12155: Security fix for NULL pointer     dereference while releasing spice resources     (bsc#1135902).

  - CVE-2019-13164: Security fix for qemu-bridge-helper ACL     can be bypassed when names are too long (bsc#1140402).

  - CVE-2019-5008: Fix DoS (NULL pointer dereference) in     sparc64 virtual machine possible through guest device     driver (bsc#1133031).

Bug fixes and enhancements :

  - Upstream tweaked SnowRidge-Server vcpu model to now be     simply Snowridge (jsc#SLE-4883)

  - Add SnowRidge-Server vcpu model (jsc#SLE-4883)

  - Add in documentation about md-clear feature     (bsc#1138534)

  - Fix SEV issue where older machine type is not processed     correctly (bsc#1144087)

  - Fix case of a bad pointer in Xen PV usb support code     (bsc#1128106)

  - Further refine arch-capabilities handling to help with     security and performance in Intel hosts (bsc#1134883,     bsc#1135210) (fate#327764)

  - Add support for one more security/performance related     vcpu feature (bsc#1136778) (fate#327796)

  - Ignore csske for expanding the cpu model (bsc#1136540)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for qemu fixes the following issues :

Security issues fixed :

CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).

CVE-2019-12155: Security fix for NULL pointer dereference while releasing spice resources (bsc#1135902).

CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

CVE-2019-5008: Fix DoS (NULL pointer dereference) in sparc64 virtual machine possible through guest device driver (bsc#1133031).

Bug fixes and enhancements: Upstream tweaked SnowRidge-Server vcpu model to now be simply Snowridge (jsc#SLE-4883)

Add SnowRidge-Server vcpu model (jsc#SLE-4883)

Add in documentation about md-clear feature (bsc#1138534)

Fix SEV issue where older machine type is not processed correctly (bsc#1144087)

Fix case of a bad pointer in Xen PV usb support code (bsc#1128106)

Further refine arch-capabilities handling to help with security and performance in Intel hosts (bsc#1134883, bsc#1135210) (fate#327764)

Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796)

Ignore csske for expanding the cpu model (bsc#1136540)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap buffer overflow issue was found in the load_device_tree() function of QEMU, which is invoked to load a device tree blob at boot time. It occurs due to device tree size manipulation before buffer allocation, which could overflow a signed int type. A user/process could use this flaw to potentially execute arbitrary code on a host system with privileges of the QEMU process. (CVE-2018-20815)

hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL pointer dereference, which allows the attacker to cause a denial of service via a device driver. (CVE-2019-5008)

Slirp: information leakage in tcp_emu() due to uninitialized stack variables (CVE-2019-9824)

qxl: NULL pointer dereference while releasing spice resources (CVE-2019-12155)

- CVE-2019-12155: qxl: NULL pointer dereference while     releasing spice resources (bz #1712727, bz #1712670)

  - CVE-2019-5008: NULL pointer dereference in     hw/sparc64/sun4u.c leading to DoS (bz #1705916, bz     #1705915)

  - CVE-2018-20815: device_tree: heap buffer overflow while     loading device tree blob (bz #1693117, bz #1693101)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2019-12155: qxl: NULL pointer dereference while     releasing spice resources (bz #1712727, bz #1712670)

  - CVE-2019-5008: NULL pointer dereference in     hw/sparc64/sun4u.c leading to DoS (bz #1705916, bz     #1705915)

  - CVE-2018-20815: device_tree: heap buffer overflow while     loading device tree blob (bz #1693117, bz #1693101)

  - CVE-2019-9824: Slirp: information leakage in tcp_emu()     due to uninitialized stack variables (bz #1689794, bz     #1678515)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3978-1 advisory.

    Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan Horea Lutas, Andrei Lutas,     Volodymyr Pikhur, Stephan van Schaik, Alyssa Milburn, Sebastian sterlund, Pietro Frigo, Kaveh Razavi,     Herbert Bos, Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss discovered that memory     previously stored in microarchitectural fill buffers of an Intel CPU core may be exposed to a malicious     process that is executing on the same CPU core. A local attacker could use this to expose sensitive     information. (CVE-2018-12130)

    Brandon Falk, Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Stephan van Schaik, Alyssa Milburn,     Sebastian sterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida discovered that     memory previously stored in microarchitectural load ports of an Intel CPU core may be exposed to a     malicious process that is executing on the same CPU core. A local attacker could use this to expose     sensitive information. (CVE-2018-12127)

    Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Marina Minkin, Daniel Moghimi, Moritz Lipp, Michael     Schwarz, Jo Van Bulck, Daniel Genkin, Daniel Gruss, Berk Sunar, Frank Piessens, and Yuval Yarom discovered     that memory previously stored in microarchitectural store buffers of an Intel CPU core may be exposed to a     malicious process that is executing on the same CPU core. A local attacker could use this to expose     sensitive information. (CVE-2018-12126)

    Kurtis Miller discovered that a buffer overflow existed in QEMU when loading a device tree blob. A local     attacker could use this to execute arbitrary code. (CVE-2018-20815)

    Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Volodrmyr Pikhur, Moritz Lipp, Michael Schwarz,     Daniel Gruss, Stephan van Schaik, Alyssa Milburn, Sebastian sterlund, Pietro Frigo, Kaveh Razavi,     Herbert Bos, and Cristiano Giuffrida discovered that uncacheable memory previously stored in     microarchitectural buffers of an Intel CPU core may be exposed to a malicious process that is executing on     the same CPU core. A local attacker could use this to expose sensitive information. (CVE-2019-11091)

    It was discovered that a NULL pointer dereference existed in the sun4u power device implementation in     QEMU. A local attacker could use this to cause a denial of service. This issue only affected Ubuntu 18.10     and Ubuntu 19.04. (CVE-2019-5008)

    William Bowling discovered that an information leak existed in the SLiRP networking implementation of     QEMU. An attacker could use this to expose sensitive information. (CVE-2019-9824)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
139983	EulerOS 2.0 SP8 : qemu (EulerOS-SA-2020-1880)	Nessus	Huawei Local Security Checks	Local	high
128457	openSUSE Security Update : qemu (openSUSE-2019-2041)	Nessus	SuSE Local Security Checks	Local	high
128074	SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2019:2192-1)	Nessus	SuSE Local Security Checks	Local	high
126960	Amazon Linux 2 : qemu (ALAS-2019-1248)	Nessus	Amazon Linux Local Security Checks	Local	critical
126533	Fedora 29 : 2:qemu (2019-e9de40d53f)	Nessus	Fedora Local Security Checks	Local	critical
126530	Fedora 30 : 2:qemu (2019-52a8f5468e)	Nessus	Fedora Local Security Checks	Local	critical
125137	Ubuntu 16.04 LTS / 18.04 LTS : QEMU update (USN-3978-1)	Nessus	Ubuntu Local Security Checks	Local	critical

Detections

Analytics

CVE-2019-5008

high

Tenable Plugins

high

high

high

critical

critical

critical

critical