Debian Qemu vulnerabilities

CVE-2023-40360 [MEDIUM] CVE-2023-40360: qemu - QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/... QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance group is configured before checking whether Flexible Data Placement is enabled. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 1:8.0.4+dfsg-2) sid: resolved (fixed in 1:8.0.4+dfsg-2) trixie: resolved (

CVE-2023-1386 [LOW] CVE-2023-1386: qemu - A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU.... A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host local user

CVE-2022-3872 [HIGH] CVE-2022-3872: qemu - An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs ... An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count == block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. Scope: local bookworm: open b

CVE-2022-1050 [HIGH] CVE-2022-1050: qemu - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device.... A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition. Scope: local bookworm: resolved (fixed in 1:7.1+dfsg-2) bullseye: resolved (fixed in 1:5.2+dfsg-11+deb11u3) forky: resolved (fixed in 1

CVE-2022-0358 [HIGH] CVE-2022-0358: qemu - A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) imp... A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This

CVE-2022-2962 [HIGH] CVE-2022-2962: qemu - A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tul... A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possibly leading to a stack or heap overflow. A malicious guest could use this fla

CVE-2022-26353 [HIGH] CVE-2022-26353: qemu - A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently i... A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and other unexpected results. Affected QEMU version: 6.2.0. Scope: local bookworm: resolved (fixed in 1:7.0+dfsg-1) bullseye: resolved (fixed in 1:5.2+dfsg-11+de

CVE-2022-4144 [MEDIUM] CVE-2022-4144: qemu - An out-of-bounds read flaw was found in the QXL display device emulation in QEMU... An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of servi

CVE-2022-0216 [MEDIUM] CVE-2022-0216: qemu - A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter... A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service. Scope: local bookw

CVE-2022-3165 [MEDIUM] CVE-2022-3165: qemu - An integer underflow issue was found in the QEMU VNC server while processing Cli... An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service. Scope: local bookworm: resolved (fixed in 1:7.2+dfsg-1) bullseye: resolved forky: resolved (fixed in

CVE-2022-4172 [MEDIUM] CVE-2022-4172: qemu - An integer overflow and buffer overflow issues were found in the ACPI Error Reco... An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use these flaws to crash the QEMU process on the host. Scope: lo

CVE-2022-36648 [CRITICAL] CVE-2022-36648: qemu - The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in ... The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. Note: This has been disputed by multiple third parties as not a valid vulnerability due to the rocker device not f

CVE-2022-35414 [HIGH] CVE-2022-35414: qemu - softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the... softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time. Scope: local bookworm

CVE-2022-26354 [LOW] CVE-2022-26354: qemu - A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid... A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0. Scope: local bookworm: resolved (fixed in 1:7.0+dfsg-1) bullseye: resolved (fixed in 1:5.2+dfsg-11+deb11u2) forky: resolved (fixed

CVE-2021-3546 [HIGH] CVE-2021-3546: qemu - An out-of-bounds write vulnerability was found in the virtio vhost-user GPU devi... An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw occurs while processing the 'VIRTIO_GPU_CMD_GET_CAPSET' command from the guest. It could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service condition, or potential code

CVE-2021-3929 [HIGH] CVE-2021-3929: qemu - A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation ... A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a d

CVE-2021-3682 [HIGH] CVE-2021-3682: qemu - A flaw was found in the USB redirector device emulation of QEMU in versions prio... A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with th

CVE-2021-4207 [HIGH] CVE-2021-4207: qemu - A flaw was found in the QXL display device emulation in QEMU. A double fetch of ... A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execut

CVE-2021-3748 [HIGH] CVE-2021-3748: qemu - A use-after-free vulnerability was found in the virtio-net device of QEMU. It co... A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host wi

CVE-2021-20181 [HIGH] CVE-2021-20181: qemu - A race condition flaw was found in the 9pfs server implementation of QEMU up to ... A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability. Scope: local bookworm: resolved (fi