Debian Qemu vulnerabilities

CVE-2021-4206 [HIGH] CVE-2021-4206: qemu - A flaw was found in the QXL display device emulation in QEMU. An integer overflo... A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QE

CVE-2021-3750 [HIGH] CVE-2021-3750: qemu - A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. E... A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a

CVE-2021-3713 [HIGH] CVE-2021-3713: qemu - An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emul... An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code executio

CVE-2021-3582 [MEDIUM] CVE-2021-3582: qemu - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device.... A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" command due to improper memory remapping (mremap). This flaw allows a malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to system availability. Scope: local bookworm: resolved (fixed

CVE-2021-3608 [MEDIUM] CVE-2021-3608: qemu - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device ... A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest and may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest threat from this vulnerability is to system availability. Scope: l

CVE-2021-3544 [MEDIUM] CVE-2021-3544: qemu - Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-... Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime. Scope: local bookworm: resolved (fixed in 1:6.1+dfsg-1) bullseye: resolved (fix

CVE-2021-4158 [MEDIUM] CVE-2021-4158: qemu - A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious... A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. Scope: local bookworm: resolved (fixed in 1:6.2+dfsg-2) bullseye: resolved forky: resolved (fixed in 1:6.2+dfsg-2) sid: resolved (fixed in 1:6.2+dfsg-2)

CVE-2021-3947 [MEDIUM] CVE-2021-3947: qemu - A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies i... A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information. Scope: local bookworm: resolved (fixed in 1:6.2+dfsg-1) bullseye: resolved forky: resolved (fixed in

CVE-2021-20255 [MEDIUM] CVE-2021-20255: qemu - A stack overflow via an infinite recursion vulnerability was found in the eepro1... A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controller commands due to a DMA reentry issue. This flaw allows a guest user or process to consume CPU cycles or crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulner

CVE-2021-3545 [MEDIUM] CVE-2021-3545: qemu - An information disclosure vulnerability was found in the virtio vhost-user GPU d... An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit this issue to leak memory from the host. Scope: local

CVE-2021-3527 [MEDIUM] CVE-2021-3527: qemu - A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB pac... A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malici

CVE-2021-20196 [MEDIUM] CVE-2021-20196: qemu - A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. T... A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is

CVE-2021-20257 [MEDIUM] CVE-2021-20257: qemu - An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issu... An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system a

CVE-2021-3416 [MEDIUM] CVE-2021-3416: qemu - A potential stack overflow via infinite loop issue was found in various NIC emul... A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario. Scope: local bookworm: res

CVE-2021-20221 [MEDIUM] CVE-2021-20221: qemu - An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt... An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating controller state fields and their subseque

CVE-2021-3930 [MEDIUM] CVE-2021-3930: qemu - An off-by-one error was found in the SCSI device emulation in QEMU. It could occ... An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition. Scope: local bookworm: resolved (fixed in 1:6.2+dfsg-1) bullsey

CVE-2021-3638 [MEDIUM] CVE-2021-3638: qemu - An out-of-bounds memory access flaw was found in the ATI VGA device emulation of... An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. Scope: local

CVE-2021-3611 [MEDIUM] CVE-2021-3611: qemu - A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda... A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0. Scope: local bookworm: resolved (fixed in

CVE-2021-3735 [MEDIUM] CVE-2021-3735: qemu - A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a... A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. A privileged user inside the guest could use this flaw to hang the QEMU process on the host, resulting in a denial of service condition. The highest threat fro

CVE-2021-3409 [MEDIUM] CVE-2021-3409: qemu - The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus ma... The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (includin