Debian update for qemu

1) Memory leak

EUVDB-ID: #VU53679

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-3544

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote user to perform DoS attack on the target system.

The vulnerability exists due to multiple memory leaks in the vhost-user-gpu/vhost-user-gpu.c. A remote authenticated user of the guest operating system can force the application to leak memory and perform denial of service attack.

Mitigation

Update qemu package to version 1:5.2+dfsg-11+deb11u1.

Vulnerable software versions

Debian Linux: All versions

qemu (Debian package): before 1:5.2+dfsg-11+deb11u1

CPE2.3

• cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
• cpe:2.3:o:debian:qemu_debian_package:*:*:*:*:*:debian_linux:*:*

External links

https://www.debian.org/security/2021/dsa-4980

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU53680

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3545

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to uninitialized memory disclosure within the virgl_cmd_get_capset_info() function in vhost-user-gpu/virgl.c. A remote authenticated user of the guest operating system can gain unauthorized access to sensitive information on the system.

Mitigation

Update qemu package to version 1:5.2+dfsg-11+deb11u1.

Vulnerable software versions

Debian Linux: All versions

qemu (Debian package): before 1:5.2+dfsg-11+deb11u1

CPE2.3

• cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
• cpe:2.3:o:debian:qemu_debian_package:*:*:*:*:*:debian_linux:*:*

External links

https://www.debian.org/security/2021/dsa-4980

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds write

EUVDB-ID: #VU53681

Risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-3546

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing untrusted input within the virgl_cmd_get_capset() function in vhost-user-gpu/virgl.c. A remote authenticated user of the guest operating system can trigger an out-of-bounds write and escalate privileges.

Mitigation

Update qemu package to version 1:5.2+dfsg-11+deb11u1.

Vulnerable software versions

Debian Linux: All versions

qemu (Debian package): before 1:5.2+dfsg-11+deb11u1

CPE2.3

• cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
• cpe:2.3:o:debian:qemu_debian_package:*:*:*:*:*:debian_linux:*:*

External links

https://www.debian.org/security/2021/dsa-4980

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Out-of-bounds write

EUVDB-ID: #VU72306

Risk: Medium

CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-3638

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the ATI VGA device emulation of QEMU within the ati_2d_blt() routine while handling MMIO write operations. A malicious guest can crash the QEMU process on the host.

Mitigation

Update qemu package to version 1:5.2+dfsg-11+deb11u1.

Vulnerable software versions

Debian Linux: All versions

qemu (Debian package): before 1:5.2+dfsg-11+deb11u1

CPE2.3

• cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
• cpe:2.3:o:debian:qemu_debian_package:*:*:*:*:*:debian_linux:*:*

External links

https://www.debian.org/security/2021/dsa-4980

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Release of invalid pointer or reference

EUVDB-ID: #VU63778

Risk: Low

CVSSv4.0: 5.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3682

CWE-ID: CWE-763 - Release of invalid pointer or reference

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists in the USB redirector device emulation of QEMU when dropping packets during a bulk transfer from a SPICE client. A remote user can make QEMU call free() with faked heap chunk metadata to perform a denial of service or escalate privileges on the system.

Mitigation

Update qemu package to version 1:5.2+dfsg-11+deb11u1.

Vulnerable software versions

Debian Linux: All versions

qemu (Debian package): before 1:5.2+dfsg-11+deb11u1

CPE2.3

• cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
• cpe:2.3:o:debian:qemu_debian_package:*:*:*:*:*:debian_linux:*:*

External links

https://www.debian.org/security/2021/dsa-4980

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Out-of-bounds write

EUVDB-ID: #VU63779

Risk: Medium

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-3713

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in the UAS (USB Attached SCSI) device emulation of QEMU. A local user can perform a denial of service or escalate privileges on the system.

Mitigation

Update qemu package to version 1:5.2+dfsg-11+deb11u1.

Vulnerable software versions

Debian Linux: All versions

qemu (Debian package): before 1:5.2+dfsg-11+deb11u1

CPE2.3

• cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
• cpe:2.3:o:debian:qemu_debian_package:*:*:*:*:*:debian_linux:*:*

External links

https://www.debian.org/security/2021/dsa-4980

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU58813

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2021-3748

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote guest to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when in the virtio-net device of QEMU. A malicious guest can trigger the use-after-free error and execute arbitrary code on the host system with QEMU privileges.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update qemu package to version 1:5.2+dfsg-11+deb11u1.

Vulnerable software versions

Debian Linux: All versions

qemu (Debian package): before 1:5.2+dfsg-11+deb11u1

CPE2.3

• cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
• cpe:2.3:o:debian:qemu_debian_package:*:*:*:*:*:debian_linux:*:*

External links

https://www.debian.org/security/2021/dsa-4980

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.