Summary
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.
Security Fix(es):
* QEMU: e1000e: heap use-after-free in e1000e_write_packet_to_guest() (CVE-2023-3019)
* QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service (CVE-2023-3255)
* QEMU: improper IDE controller reset can lead to MBR overwrite (CVE-2023-5088)
* QEMU: VNC: NULL pointer dereference in qemu_clipboard_request() (CVE-2023-6683)
* QEMU: am53c974: denial of service due to division by zero (CVE-2023-42467)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | qemu-guest-agent | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-img | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-audio-pa | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-block-blkio | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-block-curl | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-block-rbd | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-common | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-core | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-device-display-virtio-gpu | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-device-display-virtio-gpu-ccw | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-device-display-virtio-gpu-pci | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-device-display-virtio-vga | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-device-usb-host | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-device-usb-redirect | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-docs | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-tools | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-ui-egl-headless | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-kvm-ui-opengl | 17:8.2.0-11.el9_4 |
| AlmaLinux · 9 | qemu-pr-helper | 17:8.2.0-11.el9_4 |
Vulnerabilities 5
-
Medium 6.5
Qemu: vnc: infinite loop in inflate_buffer() leads to denial of service
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authent…
-
Medium 6.5
Qemu: vnc: null pointer dereference in qemu_clipboard_request()
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL …
-
Medium 6.4
Qemu: improper ide controller reset can lead to mbr overwrite
A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored…
-
Medium 6.0
Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest()
A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
-
Unscored —
QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate…
References
-
report
https://access.redhat.com/security/cve/CVE-2023-3019
-
report
https://access.redhat.com/security/cve/CVE-2023-3255
-
report
https://access.redhat.com/security/cve/CVE-2023-42467
-
report
https://access.redhat.com/security/cve/CVE-2023-5088
-
report
https://access.redhat.com/security/cve/CVE-2023-6683
-
report
https://bugzilla.redhat.com/2218486
-
report
https://bugzilla.redhat.com/2222351
-
report
https://bugzilla.redhat.com/2238291
-
report
https://bugzilla.redhat.com/2247283
-
report
https://bugzilla.redhat.com/2254825
-
advisory
https://errata.almalinux.org/9/ALSA-2024-2135.html