Bugzilla – Bug 1188609
VUL-1: CVE-2021-3638: qemu: ati-vga: inconsistent check in ati_2d_blt() may lead to out-of-bounds write
Last modified: 2024-04-30 09:26:48 UTC
rh#1979858 A flaw was found in the ATI VGA emulation of QEMU. An inconsistent check and use of dst_[x|y] and s->regs.dst_[x|y] may lead to out-of-bounds write of vram_ptr. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations from the guest. A malicious guest user could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. Note: this is similar to CVE-2020-11869, CVE-2020-24352 and CVE-2020-27616. References: https://bugzilla.redhat.com/show_bug.cgi?id=1979858 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3638
So, the proposed patch, i.e.: https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg01682.html is not being applied. Discussion on it stopped, AFAICT, in Sept 2021. the RH bug is closed as NOTABUG (although, checking the history there, discussion continued after that). I don't think we're getting anywhere here. The score is not so low (6.5), but this is nevertheless being ignored. I can ping the upstream discussion, but not now, as I don't have the time for it. Will continue monitor if anything changes, but let's not hold our breath...
And, it made it, as commit: 205ccfd7a5ec86bd9a5678b8bd157562fc9a1643 :-) What branches do we want this in?
(In reply to Dario Faggioli from comment #4) > And, it made it, as commit: 205ccfd7a5ec86bd9a5678b8bd157562fc9a1643 :-) > > What branches do we want this in? BTW, it's in since QEMU 7.2, so 15-SP5 and later are ok automatically.
SUSE-SU-2023:3444-1: An update that solves six vulnerabilities can now be installed. Category: security (important) Bug References: 1188609, 1190011, 1207205, 1212850, 1213414, 1213925 CVE References: CVE-2021-3638, CVE-2021-3750, CVE-2023-0330, CVE-2023-3180, CVE-2023-3301, CVE-2023-3354 Sources used: SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): qemu-5.2.0-150300.127.3 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): qemu-5.2.0-150300.127.3 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): qemu-5.2.0-150300.127.3 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): qemu-5.2.0-150300.127.3 SUSE Manager Proxy 4.2 (src): qemu-5.2.0-150300.127.3 SUSE Manager Retail Branch Server 4.2 (src): qemu-5.2.0-150300.127.3 SUSE Manager Server 4.2 (src): qemu-5.2.0-150300.127.3 SUSE Enterprise Storage 7.1 (src): qemu-5.2.0-150300.127.3 SUSE Linux Enterprise Micro 5.1 (src): qemu-5.2.0-150300.127.3 SUSE Linux Enterprise Micro 5.2 (src): qemu-5.2.0-150300.127.3 SUSE Linux Enterprise Micro for Rancher 5.2 (src): qemu-5.2.0-150300.127.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:3721-1: An update that solves 10 vulnerabilities and has one security fix can now be installed. Category: security (important) Bug References: 1172382, 1188609, 1190011, 1193880, 1197653, 1198712, 1207205, 1212850, 1212968, 1213925, 1215311 CVE References: CVE-2020-13754, CVE-2021-3638, CVE-2021-3750, CVE-2021-3929, CVE-2022-1050, CVE-2022-26354, CVE-2023-0330, CVE-2023-2861, CVE-2023-3180, CVE-2023-3354 Sources used: openSUSE Leap 15.4 (src): qemu-4.2.1-150200.79.1 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): qemu-4.2.1-150200.79.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): qemu-4.2.1-150200.79.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): qemu-4.2.1-150200.79.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4056-1: An update that solves five vulnerabilities and has four security fixes can now be installed. Category: security (important) Bug References: 1179993, 1181740, 1188609, 1190011, 1207205, 1212850, 1213663, 1213925, 1215311 CVE References: CVE-2021-3638, CVE-2021-3750, CVE-2023-0330, CVE-2023-3180, CVE-2023-3354 Sources used: openSUSE Leap 15.4 (src): qemu-linux-user-6.2.0-150400.37.23.1, qemu-6.2.0-150400.37.23.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): qemu-6.2.0-150400.37.23.1 SUSE Linux Enterprise Micro 5.3 (src): qemu-6.2.0-150400.37.23.1 SUSE Linux Enterprise Micro for Rancher 5.4 (src): qemu-6.2.0-150400.37.23.1 SUSE Linux Enterprise Micro 5.4 (src): qemu-6.2.0-150400.37.23.1 Basesystem Module 15-SP4 (src): qemu-6.2.0-150400.37.23.1 Server Applications Module 15-SP4 (src): qemu-6.2.0-150400.37.23.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4662-1: An update that solves three vulnerabilities and has two security fixes can now be installed. Category: security (important) Bug References: 1188609, 1212850, 1213210, 1213925, 1215311 CVE References: CVE-2021-3638, CVE-2023-3180, CVE-2023-3354 Sources used: openSUSE Leap 15.5 (src): qemu-linux-user-7.1.0-150500.49.9.1, qemu-7.1.0-150500.49.9.2 SUSE Linux Enterprise Micro 5.5 (src): qemu-7.1.0-150500.49.9.2 Basesystem Module 15-SP5 (src): qemu-7.1.0-150500.49.9.2 Server Applications Module 15-SP5 (src): qemu-7.1.0-150500.49.9.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:0589-1: An update that solves three vulnerabilities and has two security fixes can now be installed. Category: security (important) Bug References: 1188609, 1212850, 1213210, 1213925, 1215311 CVE References: CVE-2021-3638, CVE-2023-3180, CVE-2023-3354 Sources used: SUSE Package Hub 15 15-SP5 (src): qemu-7.1.0-150500.49.9.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Closing as resolved.