CVSS: 7.7EPSS: 0%CPEs: 8EXPL: 0CVE-2020-1711 – QEMU: block: iscsi: OOB heap access via an unexpected response of iSCSI Server
https://notcve.org/view.php?id=CVE-2020-1711
An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host. Se detectó una fallo de acceso al búfer de la pila fuera de límites en la manera en que el controlador de iSCSI Block versiones 2.xx de QEMU hasta 2.12.0 incluyéndola, manejó una respuesta proveniente de un servidor iSCSI mientras se comprobaba el estado de un Logical Address Block (LBA) en una rutina iscsi_co_block_status(). Un usuario remoto podría usar este fallo para bloquear el proceso de QEMU, resultando en una denegación de servicio o posible ejecución de código arbitrario con privilegios del proceso de QEMU en el host. An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html https://access.redhat.com/errata/RHSA-2020:0669 https://access.redhat.com/errata/RHSA-2020:0730 https://access.redhat.com/errata/RHSA-2020:0731 https://access.redhat.com/errata/RHSA-2020:0773 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1711 https://lists.debian.org/debian-lts-announce/2020/03/msg00017.html https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html https://lists.gnu&# • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-20175
https://notcve.org/view.php?id=CVE-2019-20175
An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system via a special SCSI_IOCTL_SEND_COMMAND. It hits an assertion that implies that the size of successful DMA transfers there must be a multiple of 512 (the size of a sector). NOTE: a member of the QEMU security team disputes the significance of this issue because a "privileged guest user has many ways to cause similar DoS effect, without triggering this assert. ** EN DISPUTA ** Se descubrió un problema en la función ide_dma_cb() en el archivo hw/ide/core.c en QEMU versiones 2.4.0 hasta la versión 4.2.0. El sistema invitado puede bloquear el proceso de QEMU en el sistema host por medio de un SCSI_IOCTL_SEND_COMMAND especial. • https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg01651.html https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg03869.html https://lists.nongnu.org/archive/html/qemu-devel/2019-11/msg00597.html https://lists.nongnu.org/archive/html/qemu-devel/2019-11/msg02165.html https://www.mail-archive.com/qemu-devel%40nongnu.org/msg667396.html • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 3CVE-2013-2016
https://notcve.org/view.php?id=CVE-2013-2016
A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host. Se encontró un fallo en la manera en que qemu versión v1.3.0 y posteriores (virtio-rng) comprueba las direcciones cuando el invitado accede al espacio de configuración de un dispositivo virtio. Si el dispositivo virtio posee un espacio de configuración de tamaño cero o pequeño, ta y como virtio-rng, un usuario invitado privilegiado podría usar este fallo para acceder al espacio de direcciones qemu del host correspondiente y así aumentar sus privilegios en el host. • http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00002.html http://www.openwall.com/lists/oss-security/2013/04/29/5 http://www.openwall.com/lists/oss-security/2013/04/29/6 http://www.securityfocus.com/bid/59541 https://access.redhat.com/security/cve/cve-2013-2016 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2016 https://exchange.xforce.ibmcloud.com/vulnerabilities/83850 https://github.com/qemu/qemu/commit/5f5a1318653c08e435cfa52f60b6a712815b659d https://securi • CWE-269: Improper Privilege Management •
CVSS: 3.8EPSS: 0%CPEs: 15EXPL: 0CVE-2019-12068
https://notcve.org/view.php?id=CVE-2019-12068
In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well. En QEMU versiones 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, y 1:2.1+dfsg-12+deb8u12 (corregida), cuando se ejecuta el script en la función lsi_execute_script(), el emulador del adaptador scsi de LSI avanza el índice "s-)dsp" para leer el próximo opcode. Esto puede conllevar a un bucle infinito si el siguiente opcode está vacío. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00034.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00038.html https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=de594e47659029316bbf9391efb79da0a1a08e08 https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01518.html https://security-tracker.debian.org/tracker/CVE-2019-12068 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2019-15890 – QEMU: Slirp: use-after-free during packet reassembly
https://notcve.org/view.php?id=CVE-2019-15890
libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. libslirp versión 4.0.0, como es usado en QEMU versión 4.1.0, presenta un uso de la memoria previamente liberada en la función ip_reass en el archivo ip_input.c. A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. The issue occurs in ip_reass() routine while reassembling incoming packets, if the first fragment is bigger than the m->m_dat[] buffer. A user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00034.html http://www.openwall.com/lists/oss-security/2019/09/06/3 https://access.redhat.com/errata/RHSA-2020:0775 https://gitlab.freedesktop.org/slirp/libslirp/commit/c5927943 https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html https://seclists.org/bugtraq/2020/Feb/0 https://usn.ubuntu.com/4191-1 https://usn.ubuntu.com/4191-2 https://www.debian.org/security/2020/dsa-4616 https://ac • CWE-416: Use After Free •