This update for qemu fixes the following issues :

Security issues fixed :

  - CVE-2019-9824: Fixed information leak in slirp     (bsc#1129622).

  - CVE-2019-8934: Added method to specify whether or not to     expose certain ppc64 hostinformation (bsc#1126455).

  - CVE-2019-3812: Fixed Out-of-bounds memory access and     information leak in virtual monitor interface     (bsc#1125721).

  - CVE-2018-20815: Fixed a denial of service possibility in     device tree processing (bsc#1130675).

Non-security issue fixed :

  - Backported Skylake-Server vcpu model support from qemu     v2.11 (FATE#327261 bsc#1131955).

  - Added ability to set virtqueue size using virtqueue_size     parameter (FATE#327255 bsc#1118900).

This update was imported from the SUSE:SLE-12-SP3:Update update project.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4640 advisory.

  - pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error.
    (CVE-2018-20123)

  - In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow. (CVE-2019-6778)

  - Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing     speculative execution may allow an authenticated user to potentially enable information disclosure via a     side channel with local access. A list of impacted products can be found here:
    https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-     update-guidance_05132019.pdf (CVE-2018-12126)

  - Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing     speculative execution may allow an authenticated user to potentially enable information disclosure via a     side channel with local access. A list of impacted products can be found here:
    https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-     update-guidance_05132019.pdf (CVE-2018-12130)

  - Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing     speculative execution may allow an authenticated user to potentially enable information disclosure via a     side channel with local access. A list of impacted products can be found here:
    https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-     update-guidance_05132019.pdf (CVE-2018-12127)

  - Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors     utilizing speculative execution may allow an authenticated user to potentially enable information     disclosure via a side channel with local access. A list of impacted products can be found here:
    https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-     update-guidance_05132019.pdf (CVE-2019-11091)

  - The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory     corruption. (CVE-2018-19665)

  - In QEMU 3.1, scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and read     operations. (CVE-2019-6501)

  - tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an     snprintf call, leading to Information disclosure. (CVE-2019-9824)

  - Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data     type for a size value. (CVE-2018-18438)

  - In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a     buffer overflow risk. (CVE-2018-20815)

  - QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128     bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands     could exploit this to read stack memory of the qemu process on the host. (CVE-2019-3812)

  - hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the     /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest. (CVE-2019-8934)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for qemu fixes the following issues :

Fix OOB access during mmio operations (CVE-2020-13754, bsc#1172382)

Fix sPAPR emulator leaks the host hardware identity (CVE-2019-8934, bsc#1126455)

Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380)

Fix out-of-bound heap buffer access via an interrupt ID field (CVE-2021-20221, bsc#1181933)

For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues:
(CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975, bsc#1031692, bsc#1094725)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Security issues fixed :

  - CVE-2019-9824: Fixed an information leak in slirp     (bsc#1129622)

  - CVE-2019-8934: Added method to specify whether or not to     expose certain ppc64 host information, which can be     considered a security issue (bsc#1126455)

  - CVE-2019-3812: Fixed OOB memory access and information     leak in virtual monitor interface (bsc#1125721)

  - CVE-2018-20815: Fix DOS possibility in device tree     processing (bsc#1130675)

  - Adjust fix for CVE-2019-8934 (bsc#1126455) to match the     latest upstream adjustments for the same. Basically now     the security fix is to provide a dummy host-model and     host-serial value, which overrides getting that value     from the host

  - CVE-2018-12126 CVE-2018-12127 CVE-2018-12130     CVE-2019-11091: Added x86 cpu feature 'md-clear'     (bsc#1111331)

Other bugs fixed :

  - Use a new approach to handling the file input to -smbios     option, which accepts either legacy or per-spec formats     regardless of the machine type.

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Published	Updated	Severity
124311	openSUSE Security Update : qemu (openSUSE-2019-1274)	Nessus	SuSE Local Security Checks	4/26/2019	1/19/2021	critical
180647	Oracle Linux 7 : qemu (ELSA-2019-4640)	Nessus	Oracle Linux Local Security Checks	9/7/2023	9/8/2023	critical
150203	SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1829-1)	Nessus	SuSE Local Security Checks	6/3/2021	12/27/2023	medium
125302	openSUSE Security Update : qemu (openSUSE-2019-1405) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	5/21/2019	12/5/2022	critical

Detections

Analytics

Plugins Search

critical

critical

medium

critical