Amazon Linux AMI update for qemu-kvm

1) Improper input validation

EUVDB-ID: #VU16553

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-15746

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The vulnerability exists in qemu-seccomp.c due to an error when processing malicious input. An adjacent attacker can leverage mishandling of the seccomp policy for threads other than the main thread and cause the service to crash.

Mitigation

Update the affected packages:

src:
    qemu-kvm-1.5.3-156.24.amzn1.src

x86_64:
    qemu-kvm-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-tools-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-common-1.5.3-156.24.amzn1.x86_64
    qemu-img-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-debuginfo-1.5.3-156.24.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

• cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1449.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Heap-based buffer overflow

EUVDB-ID: #VU20446

Risk: Medium

CVSSv4.0: 5.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-14378

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the ip_reass() function in ip_input.c in libslirp. A remote authenticated attacker can send a large packet, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

src:
    qemu-kvm-1.5.3-156.24.amzn1.src

x86_64:
    qemu-kvm-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-tools-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-common-1.5.3-156.24.amzn1.x86_64
    qemu-img-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-debuginfo-1.5.3-156.24.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

• cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1449.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds write

EUVDB-ID: #VU45985

Risk: Medium

CVSSv4.0: 7.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2020-14364

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: Yes

Description

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a boundary error within the USB emulator in QEMU. A remote user with access to guest operating system on the guest operating system can send specially crafted USB packets, trigger out-of-bounds write and execute arbitrary code on the host system.

Mitigation

Update the affected packages:

src:
    qemu-kvm-1.5.3-156.24.amzn1.src

x86_64:
    qemu-kvm-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-tools-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-common-1.5.3-156.24.amzn1.x86_64
    qemu-img-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-debuginfo-1.5.3-156.24.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

• cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1449.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Use-after-free

EUVDB-ID: #VU27389

Risk: Medium

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2020-1983

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error when processing packets within the ip_reass() function in ip_input.c in libslirp. A remote attacker can send a specially crafted packet to the application, trigger a use-after-free error and crash it.

Mitigation

Update the affected packages:

src:
    qemu-kvm-1.5.3-156.24.amzn1.src

x86_64:
    qemu-kvm-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-tools-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-common-1.5.3-156.24.amzn1.x86_64
    qemu-img-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-debuginfo-1.5.3-156.24.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

• cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:*

External links

https://alas.aws.amazon.com/ALAS-2020-1449.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.