CVE-2020-29130

El archivo slirp.c en libslirp versiones hasta 4.3.1, presenta una sobrescritura del búfer porque intenta leer una determinada cantidad de datos del encabezado inclusive si excede la longitud total del paquete

An out-of-bounds access issue was found in the SLiRP user networking implementation of QEMU. It could occur while processing ARP/NCSI packets, if the packet length was shorter than required to accommodate respective protocol headers and payload. A privileged guest user may use this flaw to potentially leak host information bytes.

An update that solves 15 vulnerabilities and has two fixes is now available. This update for qemu fixes the following issues. Fixed OOB access in sm501 device emulation. Fixed use-after-free in usb xhci packet handling. Fixed use-after-free in usb ehci packet handling. Fixed infinite loop in usb hcd-ohci emulation. Fixed OOB access in usb hcd-ohci emulation. Fixed guest triggerable assert in shared network handling code. Fixed infinite loop in e1000e device emulation. Fixed OOB access in atapi emulation. Fixed heap overflow in MSIx emulation. Fixed null pointer deref. In mmio ops. Fixed infinite loop in e1000 device emulation. Fixed OOB access in rtl8139 NIC emulation. Fixed OOB access in other NIC emulations. Fixed OOB access in ati-vga emulation. Fixed OOB access in SLIRP ARP/NCSI packet processing directories and log files SLE15-SP3, and openSUSE equivalents This update was imported from the SUSE:SLE-15-SP2:Update update project.