Amazon Linux 2 : qemu (ALAS-2023-2061)

high Nessus Plugin ID 176677

Language:

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2061 advisory.

- A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device.
This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. (CVE-2021-20196)

- A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.
(CVE-2021-3392)

- A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service. (CVE-2021-3527)

- An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.
(CVE-2021-3930)

- A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process. (CVE-2021-4207)

- An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition. (CVE-2022-4144)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update qemu' to update your system.

Plugin Details

Severity: High

ID: 176677

File Name: al2_ALAS-2023-2061.nasl

Version: 1.2

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 6/5/2023

Updated: 9/28/2023

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-4207

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.4

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:ivshmem-tools, cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:qemu-ui-sdl, p-cpe:/a:amazon:linux:qemu-kvm-core, p-cpe:/a:amazon:linux:qemu-user-binfmt, p-cpe:/a:amazon:linux:qemu-common, p-cpe:/a:amazon:linux:qemu, p-cpe:/a:amazon:linux:qemu-audio-pa, p-cpe:/a:amazon:linux:qemu-block-rbd, p-cpe:/a:amazon:linux:qemu-block-curl, p-cpe:/a:amazon:linux:qemu-debuginfo, p-cpe:/a:amazon:linux:qemu-guest-agent, p-cpe:/a:amazon:linux:qemu-system-aarch64-core, p-cpe:/a:amazon:linux:qemu-user, p-cpe:/a:amazon:linux:qemu-audio-sdl, p-cpe:/a:amazon:linux:qemu-img, p-cpe:/a:amazon:linux:qemu-system-x86-core, p-cpe:/a:amazon:linux:qemu-ui-gtk, p-cpe:/a:amazon:linux:qemu-block-dmg, p-cpe:/a:amazon:linux:qemu-block-iscsi, p-cpe:/a:amazon:linux:qemu-block-nfs, p-cpe:/a:amazon:linux:qemu-kvm, p-cpe:/a:amazon:linux:qemu-user-static, p-cpe:/a:amazon:linux:qemu-audio-oss, p-cpe:/a:amazon:linux:qemu-system-aarch64, p-cpe:/a:amazon:linux:qemu-audio-alsa, p-cpe:/a:amazon:linux:qemu-block-ssh, p-cpe:/a:amazon:linux:qemu-ui-curses, p-cpe:/a:amazon:linux:qemu-system-x86

Required KB Items: Host/AmazonLinux/rpm-list, Host/local_checks_enabled, Host/AmazonLinux/release

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/25/2023

Vulnerability Publication Date: 12/3/2020

Reference Information

CVE: CVE-2021-20196, CVE-2021-3392, CVE-2021-3527, CVE-2021-3930, CVE-2021-4207, CVE-2022-4144

IAVB: 2020-B-0075-S, 2022-B-0057-S

Detections

Analytics