ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or ati_mm_write call.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address
    in an msi-x mmio operation. (CVE-2020-13754)

  - address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
    (CVE-2020-13659)

  - hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an
    address near the end of the PCI configuration space. (CVE-2020-13791)

  - ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a
    crafted mm_index value during an ati_mm_read or ati_mm_write call. (CVE-2020-13800)

According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In QEMU through 5.0.0, an integer overflow was found in     the SM501 display driver implementation. This flaw     occurs in the COPY_AREA macro while handling MMIO write     operations through the sm501_2d_engine_write()     callback. A local attacker could abuse this flaw to     crash the QEMU process in sm501_2d_operation() in     hw/display/sm501.c on the host, resulting in a denial     of service.(CVE-2020-12829)

  - slirp.c in libslirp through 4.3.1 has a buffer     over-read because it tries to read a certain amount of     header data even if that exceeds the total packet     length.(CVE-2020-29130)

  - ncsi.c in libslirp through 4.3.1 has a buffer over-read     because it tries to read a certain amount of header     data even if that exceeds the total packet     length.(CVE-2020-29129)

  - hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop     via an RX descriptor with a NULL buffer     address.(CVE-2020-28916)

  - ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can     encounter an outside-limits situation in a calculation.
    A guest can crash the QEMU process.(CVE-2020-27616)

  - eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows     guest OS users to trigger an assertion failure. A guest     can crash the QEMU process via packet data that lacks a     valid Layer 3 protocol.(CVE-2020-27617)

  - A reachable assertion issue was found in the USB EHCI     emulation code of QEMU. It could occur while processing     USB requests due to missing handling of DMA memory map     failure. A malicious privileged user within the guest     may abuse this flaw to send bogus USB requests and     crash the QEMU process on the host, resulting in a     denial of service.(CVE-2020-25723)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based     buffer over-read via values obtained from the host     controller driver.(CVE-2020-25624)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop     when a TD list has a loop.(CVE-2020-25625)

  - In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c     misuses snprintf return values, leading to a buffer     overflow in later code.(CVE-2020-8608)

  - tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in     QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based     buffer overflow or other out-of-bounds access which can     lead to a DoS or potential execute arbitrary     code.(CVE-2020-7039)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a     heap-based buffer overflow via a large packet because     it mishandles a case involving the first     fragment.(CVE-2019-14378)

  - A flaw was found in the memory management API of QEMU     during the initialization of a memory region cache.
    This issue could lead to an out-of-bounds write access     to the MSI-X table while performing MMIO operations. A     guest user may abuse this flaw to crash the QEMU     process on the host, resulting in a denial of service.
    This flaw affects QEMU versions prior to     5.2.0.(CVE-2020-27821)

  - QEMU: reachable assertion failure in     net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c     (CVE-2020-16092)

  - hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to     trigger an out-of-bounds access by providing an address     near the end of the PCI configuration     space(CVE-2020-13791)

  - qmp_guest_file_read in qga/commands-posix.c and     qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent)     in QEMU 2.12.50 has an integer overflow causing a     g_malloc0() call to trigger a segmentation fault when     trying to allocate a large memory chunk. The     vulnerability can be exploited by sending a crafted QMP     command (including guest-file-read with a large count     value) to the agent via the listening     socket.(CVE-2018-12617)

  - sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an     unvalidated address, which leads to an out-of-bounds     read during sdhci_write() operations. A guest OS user     can crash the QEMU process.(CVE-2020-13253)

  - QEMU 4.1.0 has a memory leak in zrle_compress_data in     ui/vnc-enc-zrle.c during a VNC disconnect operation     because libz is misused, resulting in a situation where     memory allocated in deflateInit2 is not freed in     deflateEnd.(CVE-2019-20382)

  - An integer overflow was found in QEMU 4.0.1 through     4.2.0 in the way it implemented ATI VGA emulation. This     flaw occurs in the ati_2d_blt() routine in     hw/display/ati-2d.c while handling MMIO write     operations through the ati_mm_write() callback. A     malicious guest could abuse this flaw to crash the QEMU     process, resulting in a denial of     service.(CVE-2020-11869)

  - This vulnerability has been modified since it was last     analyzed by the NVD. It is awaiting reanalysis which     may result in further changes to the information     provided.(CVE-2020-13659)

  - A flaw was found in QEMU in the implementation of the     Pointer Authentication (PAuth) support for ARM     introduced in version 4.0 and fixed in version 5.0.0. A     general failure of the signature generation process     caused every PAuth-enforced pointer to be signed with     the same signature. A local attacker could obtain the     signature of a protected pointer and abuse this flaw to     bypass PAuth protection for all programs running on     QEMU.(CVE-2020-10702)

  - hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU     before 07-20-2020 has a buffer overflow. This occurs     during packet transmission and affects the highbank and     midway emulated machines. A guest user or process could     use this flaw to crash the QEMU process on the host,     resulting in a denial of service or potential     privileged code execution. This was fixed in commit     5519724a13664b43e225ca05351c60b4468e4555.(CVE-2020-1586     3)

  - In QEMU 5.0.0 and earlier, megasas_lookup_frame in     hw/scsi/megasas.c has an out-of-bounds read via a     crafted reply_queue_head field from a guest OS     user.(CVE-2020-13362)

  - ** DISPUTED ** An issue was discovered in ide_dma_cb()     in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest     system can crash the QEMU process in the host system     via a special SCSI_IOCTL_SEND_COMMAND. It hits an     assertion that implies that the size of successful DMA     transfers there must be a multiple of 512 (the size of     a sector). NOTE: a member of the QEMU security team     disputes the significance of this issue because a     'privileged guest user has many ways to cause similar     DoS effect, without triggering this     assert.'(CVE-2019-20175)

  - In QEMU 5.0.0 and earlier, es1370_transfer_audio in     hw/audio/es1370.c does not properly validate the frame     count, which allows guest OS users to trigger an     out-of-bounds access during an es1370_write()     operation.(CVE-2020-13361)

  - rom_copy() in hw/core/loader.c in QEMU 4.1.0 does not     validate the relationship between two addresses, which     allows attackers to trigger an invalid memory copy     operation.(CVE-2020-13765)

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a     use-after-free in ip_reass in     ip_input.c.(CVE-2019-15890)

  - A use after free vulnerability in ip_reass() in     ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of     service.(CVE-2020-1983)

  - ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest     OS users to trigger infinite recursion via a crafted     mm_index value during an ati_mm_read or ati_mm_write     call.(CVE-2020-13800)

  - An out-of-bounds heap buffer access flaw was found in     the way the iSCSI Block driver in QEMU versions 2.12.0     before 4.2.1 handled a response coming from an iSCSI     server while checking the status of a Logical Address     Block (LBA) in an iscsi_co_block_status() routine. A     remote user could use this flaw to crash the QEMU     process, resulting in a denial of service or potential     execution of arbitrary code with privileges of the QEMU     process on the host.(CVE-2020-1711)

  - tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does     not prevent ..\ directory traversal on     Windows.(CVE-2020-7211)

  - An out-of-bounds read vulnerability was found in the     SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine     while replying to an ICMP echo request, also known as     ping. This flaw allows a malicious guest to leak the     contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of     libslirp before 4.3.1.(CVE-2020-10756)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202011-09 (QEMU: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in QEMU. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4467-1 advisory.

    Ziming Zhang and VictorV discovered that the QEMU SLiRP networking implementation incorrectly handled     replying to certain ICMP echo requests. An attacker inside a guest could possibly use this issue to leak     host memory to obtain sensitive information. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-10756)

    Eric Blake and Xueqiang Wei discovered that the QEMU NDB implementation incorrectly handled certain     requests. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-10761)

    Ziming Zhang discovered that the QEMU SM501 graphics driver incorrectly handled certain operations. An     attacker inside a guest could use this issue to cause QEMU to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2020-12829)

    It was discovered that the QEMU SD memory card implementation incorrectly handled certain memory     operations. An attacker inside a guest could possibly use this issue to cause QEMU to crash, resulting in     a denial of service. (CVE-2020-13253)

    Ren Ding and Hanqing Zhao discovered that the QEMU ES1370 audio driver incorrectly handled certain invalid     frame counts. An attacker inside a guest could possibly use this issue to cause QEMU to crash, resulting     in a denial of service. (CVE-2020-13361)

    Ren Ding and Hanqing Zhao discovered that the QEMU MegaRAID SAS SCSI driver incorrectly handled certain     memory operations. An attacker inside a guest could possibly use this issue to cause QEMU to crash,     resulting in a denial of service. (CVE-2020-13362)

    Alexander Bulekov discovered that QEMU MegaRAID SAS SCSI driver incorrectly handled certain memory space     operations. An attacker inside a guest could possibly use this issue to cause QEMU to crash, resulting in     a denial of service. (CVE-2020-13659)

    Ren Ding, Hanqing Zhao, Alexander Bulekov, and Anatoly Trosinenko discovered that the QEMU incorrectly     handled certain msi-x mmio operations. An attacker inside a guest could possibly use this issue to cause     QEMU to crash, resulting in a denial of service. (CVE-2020-13754)

    It was discovered that QEMU incorrectly handled certain memory copy operations when loading ROM contents.
    If a user were tricked into running an untrusted kernel image, a remote attacker could possibly use this     issue to run arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
    (CVE-2020-13765)

    Ren Ding, Hanqing Zhao, and Yi Ren discovered that the QEMU ATI video driver incorrectly handled certain     index values. An attacker inside a guest could possibly use this issue to cause QEMU to crash, resulting     in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-13800)

    Ziming Zhang discovered that the QEMU OSS audio driver incorrectly handled certain operations. An attacker     inside a guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service.
    This issue only affected Ubuntu 20.04 LTS. (CVE-2020-14415)

    Ziming Zhang discovered that the QEMU XGMAC Ethernet controller incorrectly handled packet transmission.
    An attacker inside a guest could use this issue to cause QEMU to crash, resulting in a denial of service,     or possibly execute arbitrary code. (CVE-2020-15863)

    Ziming Zhang discovered that the QEMU e1000e Ethernet controller incorrectly handled packet processing. An     attacker inside a guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-16092)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for qemu to version 4.2.1 fixes the following issues :

  - CVE-2020-10761: Fixed a denial of service in Network     Block Device (nbd) support infrastructure (bsc#1172710).

  - CVE-2020-13800: Fixed a denial of service possibility in     ati-vga emulation (bsc#1172495).

  - CVE-2020-13659: Fixed a NULL pointer dereference     possibility in MegaRAID SAS 8708EM2 emulation     (bsc#1172386).

  - CVE-2020-13362: Fixed an OOB access possibility in     MegaRAID SAS 8708EM2 emulation (bsc#1172383).

  - CVE-2020-13361: Fixed an OOB access possibility in     ES1370 audio device emulation (bsc#1172384).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for qemu to version 4.2.1 fixes the following issues :

CVE-2020-10761: Fixed a denial of service in Network Block Device (nbd) support infrastructure (bsc#1172710).

CVE-2020-13800: Fixed a denial of service possibility in ati-vga emulation (bsc#1172495).

CVE-2020-13659: Fixed a NULL pointer dereference possibility in MegaRAID SAS 8708EM2 emulation (bsc#1172386).

CVE-2020-13362: Fixed an OOB access possibility in MegaRAID SAS 8708EM2 emulation (bsc#1172383).

CVE-2020-13361: Fixed an OOB access possibility in ES1370 audio device emulation (bsc#1172384).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
426092	Alpine: multiple qemu packages: security update to 5.0.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
426092	Alpine: multiple qemu packages: security update to 5.0.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
406786	Alpine: multiple qemu packages: security update to 5.0.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
406786	Alpine: multiple qemu packages: security update to 5.0.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
147700	EulerOS Virtualization 2.9.0 : qemu (EulerOS-SA-2021-1667)	Nessus	Huawei Local Security Checks	high
147523	EulerOS Virtualization 2.9.1 : qemu (EulerOS-SA-2021-1632)	Nessus	Huawei Local Security Checks	high
142843	GLSA-202011-09 : QEMU: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
139725	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-4467-1)	Nessus	Ubuntu Local Security Checks	medium
139168	openSUSE Security Update : qemu (openSUSE-2020-1108)	Nessus	SuSE Local Security Checks	low
138992	SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2020:2015-1)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2020-13800

medium

Tenable Plugins

medium

medium

medium

medium

high

high

medium

medium

low

low