SB2023080618 - openEuler 22.03 LTS update for qemu

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2022-1050)

The vulnerability allows a malicious guest to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the QEMU implementation of VMWare's paravirtual RDMA device. A specially crafted driver on a malicious guest can execute HW commands when shared buffers are not yet allocated, trigger a use-after-free error and execute arbitrary code on the QEMU host.

2) Improper Privilege Management (CVE-ID: CVE-2023-0664)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper privilege management in the QEMU Guest Agent service for Windows. A local user can manipulate the QEMU Guest Agent's Windows installer via repair custom action and escalate privileges on the system.

3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-2861)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an error in the 9p passthrough filesystem (9pfs) implementation in QEMU. A local user can escape from the exported 9p tree by creating and opening a device file in the shared folder.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1474