Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS2-2023-2169

Related Vulnerabilities: CVE-2021-3592   CVE-2021-3593   CVE-2021-3594   CVE-2021-3595  

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3592) An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3593) An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3594) An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3595)

Source

ALAS2-2023-2169

Amazon Linux 2 Security Advisory: ALAS-2023-2169
Advisory Release Date: 2023-07-20 17:29 Pacific
Advisory Updated Date: 2023-07-25 23:06 Pacific
Severity: Low
Issue Overview:

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3592)

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3593)

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3594)

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3595)


Affected Packages:

qemu


Issue Correction:
Run yum update qemu to update your system.

New Packages:
aarch64:
    qemu-3.1.0-8.amzn2.0.12.aarch64
    qemu-common-3.1.0-8.amzn2.0.12.aarch64
    qemu-guest-agent-3.1.0-8.amzn2.0.12.aarch64
    qemu-img-3.1.0-8.amzn2.0.12.aarch64
    ivshmem-tools-3.1.0-8.amzn2.0.12.aarch64
    qemu-block-curl-3.1.0-8.amzn2.0.12.aarch64
    qemu-block-dmg-3.1.0-8.amzn2.0.12.aarch64
    qemu-block-iscsi-3.1.0-8.amzn2.0.12.aarch64
    qemu-block-nfs-3.1.0-8.amzn2.0.12.aarch64
    qemu-block-rbd-3.1.0-8.amzn2.0.12.aarch64
    qemu-block-ssh-3.1.0-8.amzn2.0.12.aarch64
    qemu-audio-alsa-3.1.0-8.amzn2.0.12.aarch64
    qemu-audio-oss-3.1.0-8.amzn2.0.12.aarch64
    qemu-audio-pa-3.1.0-8.amzn2.0.12.aarch64
    qemu-audio-sdl-3.1.0-8.amzn2.0.12.aarch64
    qemu-ui-curses-3.1.0-8.amzn2.0.12.aarch64
    qemu-ui-gtk-3.1.0-8.amzn2.0.12.aarch64
    qemu-ui-sdl-3.1.0-8.amzn2.0.12.aarch64
    qemu-kvm-3.1.0-8.amzn2.0.12.aarch64
    qemu-kvm-core-3.1.0-8.amzn2.0.12.aarch64
    qemu-user-3.1.0-8.amzn2.0.12.aarch64
    qemu-user-binfmt-3.1.0-8.amzn2.0.12.aarch64
    qemu-user-static-3.1.0-8.amzn2.0.12.aarch64
    qemu-system-aarch64-3.1.0-8.amzn2.0.12.aarch64
    qemu-system-aarch64-core-3.1.0-8.amzn2.0.12.aarch64
    qemu-system-x86-3.1.0-8.amzn2.0.12.aarch64
    qemu-system-x86-core-3.1.0-8.amzn2.0.12.aarch64
    qemu-debuginfo-3.1.0-8.amzn2.0.12.aarch64

i686:
    qemu-3.1.0-8.amzn2.0.12.i686
    qemu-common-3.1.0-8.amzn2.0.12.i686
    qemu-guest-agent-3.1.0-8.amzn2.0.12.i686
    qemu-img-3.1.0-8.amzn2.0.12.i686
    ivshmem-tools-3.1.0-8.amzn2.0.12.i686
    qemu-block-curl-3.1.0-8.amzn2.0.12.i686
    qemu-block-dmg-3.1.0-8.amzn2.0.12.i686
    qemu-block-iscsi-3.1.0-8.amzn2.0.12.i686
    qemu-block-nfs-3.1.0-8.amzn2.0.12.i686
    qemu-block-ssh-3.1.0-8.amzn2.0.12.i686
    qemu-audio-alsa-3.1.0-8.amzn2.0.12.i686
    qemu-audio-oss-3.1.0-8.amzn2.0.12.i686
    qemu-audio-pa-3.1.0-8.amzn2.0.12.i686
    qemu-audio-sdl-3.1.0-8.amzn2.0.12.i686
    qemu-ui-curses-3.1.0-8.amzn2.0.12.i686
    qemu-ui-gtk-3.1.0-8.amzn2.0.12.i686
    qemu-ui-sdl-3.1.0-8.amzn2.0.12.i686
    qemu-kvm-3.1.0-8.amzn2.0.12.i686
    qemu-kvm-core-3.1.0-8.amzn2.0.12.i686
    qemu-user-3.1.0-8.amzn2.0.12.i686
    qemu-user-binfmt-3.1.0-8.amzn2.0.12.i686
    qemu-user-static-3.1.0-8.amzn2.0.12.i686
    qemu-system-aarch64-3.1.0-8.amzn2.0.12.i686
    qemu-system-aarch64-core-3.1.0-8.amzn2.0.12.i686
    qemu-system-x86-3.1.0-8.amzn2.0.12.i686
    qemu-system-x86-core-3.1.0-8.amzn2.0.12.i686
    qemu-debuginfo-3.1.0-8.amzn2.0.12.i686

src:
    qemu-3.1.0-8.amzn2.0.12.src

x86_64:
    qemu-3.1.0-8.amzn2.0.12.x86_64
    qemu-common-3.1.0-8.amzn2.0.12.x86_64
    qemu-guest-agent-3.1.0-8.amzn2.0.12.x86_64
    qemu-img-3.1.0-8.amzn2.0.12.x86_64
    ivshmem-tools-3.1.0-8.amzn2.0.12.x86_64
    qemu-block-curl-3.1.0-8.amzn2.0.12.x86_64
    qemu-block-dmg-3.1.0-8.amzn2.0.12.x86_64
    qemu-block-iscsi-3.1.0-8.amzn2.0.12.x86_64
    qemu-block-nfs-3.1.0-8.amzn2.0.12.x86_64
    qemu-block-rbd-3.1.0-8.amzn2.0.12.x86_64
    qemu-block-ssh-3.1.0-8.amzn2.0.12.x86_64
    qemu-audio-alsa-3.1.0-8.amzn2.0.12.x86_64
    qemu-audio-oss-3.1.0-8.amzn2.0.12.x86_64
    qemu-audio-pa-3.1.0-8.amzn2.0.12.x86_64
    qemu-audio-sdl-3.1.0-8.amzn2.0.12.x86_64
    qemu-ui-curses-3.1.0-8.amzn2.0.12.x86_64
    qemu-ui-gtk-3.1.0-8.amzn2.0.12.x86_64
    qemu-ui-sdl-3.1.0-8.amzn2.0.12.x86_64
    qemu-kvm-3.1.0-8.amzn2.0.12.x86_64
    qemu-kvm-core-3.1.0-8.amzn2.0.12.x86_64
    qemu-user-3.1.0-8.amzn2.0.12.x86_64
    qemu-user-binfmt-3.1.0-8.amzn2.0.12.x86_64
    qemu-user-static-3.1.0-8.amzn2.0.12.x86_64
    qemu-system-aarch64-3.1.0-8.amzn2.0.12.x86_64
    qemu-system-aarch64-core-3.1.0-8.amzn2.0.12.x86_64
    qemu-system-x86-3.1.0-8.amzn2.0.12.x86_64
    qemu-system-x86-core-3.1.0-8.amzn2.0.12.x86_64
    qemu-debuginfo-3.1.0-8.amzn2.0.12.x86_64

Additional References

Red Hat: CVE-2021-3592, CVE-2021-3593, CVE-2021-3594, CVE-2021-3595

Mitre: CVE-2021-3592, CVE-2021-3593, CVE-2021-3594, CVE-2021-3595

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started