ALAS-2020-1449


Amazon Linux 1 Security Advisory: ALAS-2020-1449
Advisory Release Date: 2020-11-14 01:23 Pacific
Advisory Updated Date: 2020-11-16 20:50 Pacific
Severity: Important

Issue Overview:

qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread. (CVE-2018-15746)

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the ip_reass() routine while reassembling incoming packets if the first fragment is bigger than the m->m_dat[] buffer. An attacker could use this flaw to crash the QEMU process on the host, resulting in a Denial of Service or potentially executing arbitrary code with privileges of the QEMU process. (CVE-2019-14378)

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host. (CVE-2020-14364)

A use-after-free flaw was found in the SLiRP networking implementation of the QEMU emulator. Specifically, this flaw occurs in the ip_reass() routine while reassembling incoming IP fragments whose combined size is bigger than 65k. This flaw allows an attacker to crash the QEMU process on the host, resulting in a denial of service. (CVE-2020-1983)


Affected Packages:

qemu-kvm


Issue Correction:
Run yum update qemu-kvm to update your system.

New Packages:
src:
    qemu-kvm-1.5.3-156.24.amzn1.src

x86_64:
    qemu-kvm-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-tools-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-common-1.5.3-156.24.amzn1.x86_64
    qemu-img-1.5.3-156.24.amzn1.x86_64
    qemu-kvm-debuginfo-1.5.3-156.24.amzn1.x86_64