CVE-2020-27617

La función eth_get_gso_type en el archivo net/eth.c en QEMU versión 4.2.1, permite a usuarios de OS invitados desencadenar un error de aserción. Un invitado puede bloquear el proceso de QEMU por medio de paquetes de datos que carecen de un protocolo de Capa 3 válido

An assert(3) failure flaw was found in the networking helper functions of QEMU. This vulnerability can occur in the eth_get_gso_type() routine if a packet does not have a valid networking L3 protocol (ex. IPv4, IPv6) value. This flaw allows a guest user to crash the QEMU process on the host, resulting in a denial of service.

An update that solves 15 vulnerabilities and has two fixes is now available. This update for qemu fixes the following issues. Fixed OOB access in sm501 device emulation. Fixed use-after-free in usb xhci packet handling. Fixed use-after-free in usb ehci packet handling. Fixed infinite loop in usb hcd-ohci emulation. Fixed OOB access in usb hcd-ohci emulation. Fixed guest triggerable assert in shared network handling code. Fixed infinite loop in e1000e device emulation. Fixed OOB access in atapi emulation. Fixed heap overflow in MSIx emulation. Fixed null pointer deref. In mmio ops. Fixed infinite loop in e1000 device emulation. Fixed OOB access in rtl8139 NIC emulation. Fixed OOB access in other NIC emulations. Fixed OOB access in ati-vga emulation. Fixed OOB access in SLIRP ARP/NCSI packet processing directories and log files SLE15-SP3, and openSUSE equivalents This update was imported from the SUSE:SLE-15-SP2:Update update project.