Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0330: There is a vulnerability in the lsi53c895a device which affects the latest version of qemu. The carefully designed PoC can repeatedly trigger DMA writes but does not limit the addresses written to the DMA, resulting in reentrancy issues and eventually overflow.
Fixed packages 28
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ivshmem-tools | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-audio-alsa | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-audio-oss | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-audio-pa | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-audio-sdl | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-block-curl | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-block-dmg | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-block-iscsi | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-block-nfs | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-block-rbd | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-block-ssh | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-common | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-debuginfo | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-guest-agent | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-img | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-kvm | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-kvm-core | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-system-aarch64 | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-system-aarch64-core | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-system-x86 | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-system-x86-core | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-ui-curses | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-ui-gtk | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-ui-sdl | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-user | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-user-binfmt | 10:3.1.0-8.amzn2.0.13 |
| Amazon Linux · 2 | qemu-user-static | 10:3.1.0-8.amzn2.0.13 |
Vulnerabilities 1
-
Medium 5.3
Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow
A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0330.html