Security update for qemu SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:2358-1 Final 1 1 2023-06-02T11:36:51Z current 2023-06-02T11:36:51Z 2023-06-02T11:36:51Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for qemu This update for qemu fixes the following issues: - CVE-2022-0216: Fixed a use-after-free in lsi_do_msgout() in hw/scsi/lsi53c895a.c (bsc#1198038). - CVE-2021-3929: Fixed use-after-free in nvme, caused by DMA reentrancy issue (bsc#1193880). - CVE-2021-4207: Fixed heap buffer overflow caused by double fetch in qxl_cursor() (bsc#1198037). - CVE-2021-4206: Fixed integer overflow in cursor_alloc() (bsc#1198035). - Amend .changes file: avoid declaring a still unfixed CVE, as fixed (bsc#1187529) - Fix the build breaks caused by binutils update (bsc#1192463, bsc#1193621) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-2358,SUSE-SLE-SERVER-12-SP2-BCL-2023-2358 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20232358-1/ Link for SUSE-SU-2023:2358-1 https://lists.suse.com/pipermail/sle-security-updates/2023-June/015047.html E-Mail link for SUSE-SU-2023:2358-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1187529 SUSE Bug 1187529 https://bugzilla.suse.com/1192463 SUSE Bug 1192463 https://bugzilla.suse.com/1193621 SUSE Bug 1193621 https://bugzilla.suse.com/1193880 SUSE Bug 1193880 https://bugzilla.suse.com/1198035 SUSE Bug 1198035 https://bugzilla.suse.com/1198037 SUSE Bug 1198037 https://bugzilla.suse.com/1198038 SUSE Bug 1198038 https://www.suse.com/security/cve/CVE-2021-3929/ SUSE CVE CVE-2021-3929 page https://www.suse.com/security/cve/CVE-2021-4206/ SUSE CVE CVE-2021-4206 page https://www.suse.com/security/cve/CVE-2021-4207/ SUSE CVE CVE-2021-4207 page https://www.suse.com/security/cve/CVE-2022-0216/ SUSE CVE CVE-2022-0216 page SUSE Linux Enterprise Server 12 SP2-BCL qemu-2.6.2-41.76.1 qemu-arm-2.6.2-41.76.1 qemu-block-curl-2.6.2-41.76.1 qemu-block-dmg-2.6.2-41.76.1 qemu-block-iscsi-2.6.2-41.76.1 qemu-block-rbd-2.6.2-41.76.1 qemu-block-ssh-2.6.2-41.76.1 qemu-extra-2.6.2-41.76.1 qemu-guest-agent-2.6.2-41.76.1 qemu-ipxe-1.0.0-41.76.1 qemu-kvm-2.6.2-41.76.1 qemu-lang-2.6.2-41.76.1 qemu-linux-user-2.6.2-41.76.1 qemu-ppc-2.6.2-41.76.1 qemu-s390-2.6.2-41.76.1 qemu-seabios-1.9.1_0_gb3ef39f-41.76.1 qemu-sgabios-8-41.76.1 qemu-testsuite-2.6.2-41.76.2 qemu-tools-2.6.2-41.76.1 qemu-vgabios-1.9.1_0_gb3ef39f-41.76.1 qemu-x86-2.6.2-41.76.1 qemu-2.6.2-41.76.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-block-curl-2.6.2-41.76.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-block-rbd-2.6.2-41.76.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-block-ssh-2.6.2-41.76.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-guest-agent-2.6.2-41.76.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-ipxe-1.0.0-41.76.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-kvm-2.6.2-41.76.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-lang-2.6.2-41.76.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-seabios-1.9.1_0_gb3ef39f-41.76.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-sgabios-8-41.76.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-tools-2.6.2-41.76.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-vgabios-1.9.1_0_gb3ef39f-41.76.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL qemu-x86-2.6.2-41.76.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host. CVE-2021-3929 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-block-curl-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-block-rbd-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-block-ssh-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-guest-agent-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ipxe-1.0.0-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-kvm-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-lang-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-seabios-1.9.1_0_gb3ef39f-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-sgabios-8-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-tools-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-vgabios-1.9.1_0_gb3ef39f-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-x86-2.6.2-41.76.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232358-1/ https://www.suse.com/security/cve/CVE-2021-3929.html CVE-2021-3929 https://bugzilla.suse.com/1193880 SUSE Bug 1193880 A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process. CVE-2021-4206 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-block-curl-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-block-rbd-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-block-ssh-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-guest-agent-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ipxe-1.0.0-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-kvm-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-lang-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-seabios-1.9.1_0_gb3ef39f-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-sgabios-8-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-tools-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-vgabios-1.9.1_0_gb3ef39f-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-x86-2.6.2-41.76.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232358-1/ https://www.suse.com/security/cve/CVE-2021-4206.html CVE-2021-4206 https://bugzilla.suse.com/1198035 SUSE Bug 1198035 https://bugzilla.suse.com/1211582 SUSE Bug 1211582 A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process. CVE-2021-4207 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-block-curl-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-block-rbd-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-block-ssh-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-guest-agent-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ipxe-1.0.0-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-kvm-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-lang-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-seabios-1.9.1_0_gb3ef39f-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-sgabios-8-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-tools-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-vgabios-1.9.1_0_gb3ef39f-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-x86-2.6.2-41.76.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232358-1/ https://www.suse.com/security/cve/CVE-2021-4207.html CVE-2021-4207 https://bugzilla.suse.com/1198037 SUSE Bug 1198037 A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service. CVE-2022-0216 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-block-curl-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-block-rbd-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-block-ssh-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-guest-agent-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-ipxe-1.0.0-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-kvm-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-lang-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-seabios-1.9.1_0_gb3ef39f-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-sgabios-8-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-tools-2.6.2-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-vgabios-1.9.1_0_gb3ef39f-41.76.1 SUSE Linux Enterprise Server 12 SP2-BCL:qemu-x86-2.6.2-41.76.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232358-1/ https://www.suse.com/security/cve/CVE-2022-0216.html CVE-2022-0216 https://bugzilla.suse.com/1198038 SUSE Bug 1198038