SB2023063036 - VMware Tanzu Operations Manager update for QEMU

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2022-1050)

The vulnerability allows a malicious guest to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the QEMU implementation of VMWare's paravirtual RDMA device. A specially crafted driver on a malicious guest can execute HW commands when shared buffers are not yet allocated, trigger a use-after-free error and execute arbitrary code on the QEMU host.

2) Out-of-bounds read (CVE-ID: CVE-2022-4144)

The vulnerability allows a malicious guest user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the qxl_phys2virt() function in the QXL display device emulation in QEMU. A malicious guest user can trigger an out-of-bounds read error and crash the QEMU process on the host

3) Integer overflow (CVE-ID: CVE-2022-4172)

The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow within the read_erst_record() and write_erst_record() functions in the ACPI Error Record Serialization Table (ERST) device of QEMU. A malicious guest can overrun the host buffer allocated for the ERST memory device and crash the QEMU process on the host.

4) Out-of-bounds write (CVE-ID: CVE-2023-0330)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within hw/scsi/lsi53c895a.c in QEMU caused by a DMA-MMIO reentrancy problem. A local privileged user can trigger an out-of-bounds write and execute arbitrary code on the target system.

Remediation

Install update from vendor's website.

References

• https://tanzu.vmware.com/security/usn-6167-1