qemu-kvm-8.2.0-11.el9
エラータID: AXSA:2024-7897:02
リリース日:
2024/05/30 Thursday - 11:55
題名:
qemu-kvm-8.2.0-11.el9
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- QEMU の e1000e NIC のエミュレーション機能には、DMA
リエントランシーに起因するメモリ領域の解放後利用の問題が
あるため、認証されたローカルの攻撃者により、サービス拒否
攻撃 (クラッシュの発生) を可能とする脆弱性が存在します。
(CVE-2023-3019)
- QEMU の VNC サーバー機能の inflate_buffer() 関数には、
ループ処理の終了条件に問題があるため、リモートの攻撃者
により、認証されたクライアントから VNC サーバーへの
クリップボードの送信を介して、サービス拒否攻撃 (無限
ループ) を可能とする脆弱性が存在します。(CVE-2023-3255)
- QEMU の hw/scsi/scsi-disk.c の scsi_disk_reset() 関数には、
ゼロ除算の問題があるため、リモートの攻撃者により、
サービス拒否攻撃 (QEMU およびゲスト OS の停止) を可能
とする脆弱性が存在します。(CVE-2023-42467)
- QEMU には、多重仮想の環境下において上位のゲスト OS
からの仮想ディスクへの操作を誤って下位のゲスト OS の
仮想ディスクの LBA 0 への操作としてしまう問題があるため、
ローカルの攻撃者により、サービス拒否攻撃 (下位の仮想
マシンの仮想ディスクのブートレコードの破損) を可能とする
脆弱性が存在します。(CVE-2023-5088)
- QEMU の VNC サーバー機能の qemu_clipboard_request()
関数には、NULL ポインタデリファレンスの問題があるため、
リモートの攻撃者により、細工された VNC クライアントを
介して、サービス拒否攻撃 (クラッシュの発生) を可能とする
脆弱性が存在します。(CVE-2023-6683)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2023-3019
A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
CVE-2023-3255
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service.
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service.
CVE-2023-42467
QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately.
QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately.
CVE-2023-5088
A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.
A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.
CVE-2023-6683
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a malicious authenticated VNC client to crash QEMU and trigger a denial of service.
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a malicious authenticated VNC client to crash QEMU and trigger a denial of service.
追加情報:
N/A
ダウンロード:
SRPMS
- qemu-kvm-8.2.0-11.el9.src.rpm
MD5: 5a61f395ad1a79a1c802a2029ad6a966
SHA-256: 338a8fb78560fbf1d58b53aeb1ae7c03b5dbb181bb5571d628e63ee0526fa126
Size: 124.48 MB
Asianux Server 9 for x86_64
- qemu-guest-agent-8.2.0-11.el9.x86_64.rpm
MD5: 46c101168c9326b0d0e96be09d2d7cd3
SHA-256: 25eb156d5195540a82db974d64fe3d163acb500cfd24f0bc91c2ad1160fd081e
Size: 495.99 kB - qemu-img-8.2.0-11.el9.x86_64.rpm
MD5: f8117b62f4957f7ba1e6f3f6a35a5742
SHA-256: 71c48590bdcd2df7451ca3dfb9da0eaf82e619d319f34d88fc76e33754e2eff4
Size: 2.48 MB - qemu-kvm-8.2.0-11.el9.x86_64.rpm
MD5: 8cedb3a8c1fa0b4e758909a858065df5
SHA-256: 63b79f437b8add1d1e1cc20ccfa6b54db98dd923675aa913b08b2b2c19119681
Size: 72.22 kB - qemu-kvm-audio-pa-8.2.0-11.el9.x86_64.rpm
MD5: 945a1eeac55ffb0d8d313f6288dc34e4
SHA-256: f60b8a1cf626719a713e3605e43250341d85ae692645e5a130a0682dc54a8018
Size: 81.26 kB - qemu-kvm-block-blkio-8.2.0-11.el9.x86_64.rpm
MD5: ad26d5e7519289b12fae8ed46eb7a62e
SHA-256: 946aef157f4e93de4ce4e0656654007b43f4192a06993fd0068b278a49e06e06
Size: 84.02 kB - qemu-kvm-block-curl-8.2.0-11.el9.x86_64.rpm
MD5: 4487130c3e90a7f36bb1e9c549f669e7
SHA-256: b5ef5d33cbe3c74041c7386975bf5a2d97e0a3dfb01e2ea8761ab3f24817fc88
Size: 83.58 kB - qemu-kvm-block-rbd-8.2.0-11.el9.x86_64.rpm
MD5: ba01e2b3549ad90ca9f6bd57ed61e19d
SHA-256: d537a932ae547b35ddafcd65a71e01db61a82d3013ad31acdd6a5e8dbcf713fd
Size: 86.75 kB - qemu-kvm-common-8.2.0-11.el9.x86_64.rpm
MD5: 02abef7996beaca4277a2c54f3c81306
SHA-256: e77a597f7f702fd47242613d50fdc54429fec3dde0cc24f43de21a695d0a0f1e
Size: 669.89 kB - qemu-kvm-core-8.2.0-11.el9.x86_64.rpm
MD5: 3b1b97b3016e2f7198ba424d674b979f
SHA-256: 0a48f1f3fbd4557451cb510adc60032916e73bda7f5bfa81c635b8f2266d041a
Size: 4.33 MB - qemu-kvm-device-display-virtio-gpu-8.2.0-11.el9.x86_64.rpm
MD5: 3672ba7be27e717bc72ae38d52c45414
SHA-256: 460ea2005103833f6a5473a9102c2650c11b6f124fec3a2e75c245a845275008
Size: 92.07 kB - qemu-kvm-device-display-virtio-gpu-pci-8.2.0-11.el9.x86_64.rpm
MD5: 16680972d2c12deaae7858721d3fef79
SHA-256: be770c548948142a2512f44062cedab0ec020634d0d4c51cd62fa3bf7036907f
Size: 76.39 kB - qemu-kvm-device-display-virtio-vga-8.2.0-11.el9.x86_64.rpm
MD5: 7af0138e7d5732476438838d4ee1a3bb
SHA-256: 3033b857d2c1095caa58f41ec3e9291ca7a8c8281ba8c577f93f68069614c672
Size: 77.79 kB - qemu-kvm-device-usb-host-8.2.0-11.el9.x86_64.rpm
MD5: 0d8e530d8950a045ddb1a7b683129370
SHA-256: 44d1daf5fc53524dc6bd5310d380bd6a46a88f0e0f8b9bf1e07199c99799a9af
Size: 90.52 kB - qemu-kvm-device-usb-redirect-8.2.0-11.el9.x86_64.rpm
MD5: 4e4ed8196c50d6f3802545715cdd7a44
SHA-256: 41c303da33e1fc71d6290136ea215fcdd10b24b33127a28a2e6dd4173dfb08d4
Size: 95.25 kB - qemu-kvm-docs-8.2.0-11.el9.x86_64.rpm
MD5: d52ef5cf1b3e31e0cc37cf952f50514e
SHA-256: cb4b32082da5ef5f7757120f7ab94709831491f7dd3a055f087980c75076cf4d
Size: 1.19 MB - qemu-kvm-tools-8.2.0-11.el9.x86_64.rpm
MD5: 8a70c4bb784d4e458734e4de331225e3
SHA-256: 9fd184c581d4f7bfcbd430cad5402f2b996c13977609006f3a002b82e010894d
Size: 581.48 kB - qemu-kvm-ui-egl-headless-8.2.0-11.el9.x86_64.rpm
MD5: ff277b73880ff4483613d8daf8d6b403
SHA-256: 13948d810f4269e1e900c8a38121f88603a63bbbc763c1e7b6f03386f4a202c0
Size: 77.16 kB - qemu-kvm-ui-opengl-8.2.0-11.el9.x86_64.rpm
MD5: b038dd48f1e039b98037752774abdccb
SHA-256: a8fb369f13ee2773ca090e7f495f419e1c18745d3dc5bb56aeb90272c8450312
Size: 84.08 kB - qemu-pr-helper-8.2.0-11.el9.x86_64.rpm
MD5: e35ee97ae43dbf81862966600f90bd7e
SHA-256: b773630588445fce8e035a315d6084a1b6949df347fcd1daa0507c4c803e7359
Size: 498.31 kB
English