Bugzilla – Bug 1185981
VUL-0: CVE-2021-3546: qemu,kvm: QEMU: vhost-user-gpu: out-of-bounds write in virgl_cmd_get_capset()
Last modified: 2021-07-14 01:19:16 UTC
CVE-2021-3546 An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU. The flaw exists in virgl_cmd_get_capset() in contrib/vhost-user-gpu/virgl.c and could occur while processing the 'VIRTIO_GPU_CMD_GET_CAPSET' command. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service, or potentially execute arbitrary code on the host with the privileges of the QEMU process. This issue is analogous to CVE-2016-10028 in virtio-gpu-3d: https://bugzilla.suse.com/show_bug.cgi?id=1017084 Patch series: https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01155.html OOB write in virgl_cmd_get_capset() in virgl.c: https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01154.html References: https://bugzilla.redhat.com/show_bug.cgi?id=1958978 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3546
Affected packages: - SUSE:SLE-15-SP2:Update/qemu 4.2.1 - SUSE:SLE-15-SP3:Update/qemu 5.2.0 - openSUSE:Factory/qemu 6.0.0
Hello, These patches are not in upstream yet. I'll backport as soon as they reach upstream. Thank you
Hi Jose, here is the upstream patch [0]. [0] https://gitlab.com/qemu-project/qemu/-/commit/9f22893a.patch
(In reply to Gianluca Gabrielli from comment #3) > Hi Jose, here is the upstream patch [0]. > > [0] https://gitlab.com/qemu-project/qemu/-/commit/9f22893a.patch Thank you Gianluca. Fix will be available in the next MU.
This is an autogenerated message for OBS integration: This bug (1185981) was mentioned in https://build.opensuse.org/request/show/900159 Factory / qemu
This is an autogenerated message for OBS integration: This bug (1185981) was mentioned in https://build.opensuse.org/request/show/900191 Factory / qemu
Fixed Thank you
SUSE-SU-2021:2212-1: An update that solves three vulnerabilities and has three fixes is now available. Category: security (moderate) Bug References: 1184574,1185591,1185981,1185990,1186010,1187013 CVE References: CVE-2021-3544,CVE-2021-3545,CVE-2021-3546 JIRA References: Sources used: SUSE MicroOS 5.0 (src): qemu-4.2.1-11.22.1 SUSE Linux Enterprise Module for Server Applications 15-SP2 (src): qemu-4.2.1-11.22.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): qemu-4.2.1-11.22.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:2213-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 1185981,1185990,1186010 CVE References: CVE-2021-3544,CVE-2021-3545,CVE-2021-3546 JIRA References: Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP3 (src): qemu-5.2.0-20.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): qemu-5.2.0-20.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:2213-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 1185981,1185990,1186010 CVE References: CVE-2021-3544,CVE-2021-3545,CVE-2021-3546 JIRA References: Sources used: openSUSE Leap 15.3 (src): qemu-5.2.0-20.1
openSUSE-SU-2021:1043-1: An update that solves 14 vulnerabilities, contains one feature and has 5 fixes is now available. Category: security (moderate) Bug References: 1149813,1163019,1172380,1175534,1176681,1178683,1178935,1179477,1179484,1182846,1182975,1183979,1184574,1185591,1185981,1185990,1186010,1186290,1187013 CVE References: CVE-2019-15890,CVE-2020-10756,CVE-2020-14364,CVE-2020-25085,CVE-2020-25707,CVE-2020-25723,CVE-2020-29129,CVE-2020-29130,CVE-2020-8608,CVE-2021-20257,CVE-2021-3419,CVE-2021-3544,CVE-2021-3545,CVE-2021-3546 JIRA References: SLE-17785 Sources used: openSUSE Leap 15.2 (src): qemu-4.2.1-lp152.9.16.2, qemu-linux-user-4.2.1-lp152.9.16.1, qemu-testsuite-4.2.1-lp152.9.16.7