CVE-2019-20382: Low severity Qemu Qemu vulnerability

Q: What is CVE-2019-20382?

CVE-2019-20382 is a vulnerability found in QEMU 4.1.0 that leads to a memory leak in the VNC display driver when ZRLE and Tight encoding are enabled.

Q: What is the severity of CVE-2019-20382?

The severity of CVE-2019-20382 is low, with a CVSS score of 3.5.

Q: How can I fix CVE-2019-20382?

To fix CVE-2019-20382, you should update to QEMU version 4.2.0 or later.

Q: Where can I find more information about CVE-2019-20382?

You can find more information about CVE-2019-20382 in the references provided: [link1], [link2], [link3].

Published Sep 17, 2019

Updated

A memory leakage flaw was found in the way the VNC display driver of QEMU handled the connection disconnect when ZRLE and Tight encoding are enabled. Two VncState objects are created, and one allocates memory for the Zlib's data object. This allocated memory is not freed upon disconnection, resulting in a memory leak. An attacker able to connect to the VNC server could use this flaw to leak host memory, leading to a potential denial of service.

Other sources

A memory leakage flaw was found in the way VNC display driver of QEMU handled connection disconnect, when ZRLE, Tight encoding is enabled. It creates two vncState objects, one of which allocates memory for Zlib's data object. This allocated memory is not free'd upon disconnection resulting in the said memory leakage issue. A user able to connect to the VNC server could use this flaw to leak host memory leading to a potential DoS scenario.

Upstream patch: --------------- -> https://git.qemu.org/?p=qemu.git;a=commitdiff;h=6bf21f3d83e95bcc4ba35a7a07cc6655e8b010b0

— Red Hat

QEMU 4.1.0 has a memory leak in zrlecompressdata in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd.

Affected Software

15 affected componentsFixes available

redhat/qemu-kvm<10:1.5.3-175.el7

10:1.5.3-175.el7

redhat/qemu-kvm-ma<10:2.12.0-48.el7

10:2.12.0-48.el7

redhat/qemu-kvm-rhev<10:2.12.0-48.el7_9.1

10:2.12.0-48.el7_9.1

redhat/qemu-kvm-rhev<10:2.12.0-18.el7_6.12

10:2.12.0-18.el7_6.12

redhat/qemu-kvm-rhev<10:2.12.0-48.el7

10:2.12.0-48.el7

redhat/qemu<4.2.0

4.2.0

Qemu Qemu=4.1.0

openSUSE Leap=15.1

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=18.04

Canonical Ubuntu Linux=19.10

Canonical Ubuntu Linux=20.04

debian/qemu

1:5.2+dfsg-11+deb11u31:5.2+dfsg-11+deb11u51:7.2+dfsg-7+deb12u181:7.2+dfsg-7+deb12u151:10.0.7+ds-0+deb13u11:10.0.2+ds-2+deb13u11:10.2.1+ds-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/qemu-kvm to a version that resolves this vulnerability.
Fixed in 10:1.5.3-175.el7
Upgrade
Upgrade redhat/qemu-kvm-ma to a version that resolves this vulnerability.
Fixed in 10:2.12.0-48.el7
Upgrade
Upgrade redhat/qemu-kvm-rhev to a version that resolves this vulnerability.
Fixed in 10:2.12.0-48.el7_9.1
Upgrade
Upgrade redhat/qemu-kvm-rhev to a version that resolves this vulnerability.
Fixed in 10:2.12.0-18.el7_6.12
Upgrade
Upgrade redhat/qemu-kvm-rhev to a version that resolves this vulnerability.
Fixed in 10:2.12.0-48.el7
Upgrade
Upgrade redhat/qemu to a version that resolves this vulnerability.
Fixed in 4.2.0
Upgrade
Upgrade debian/qemu to a version that resolves this vulnerability.
Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u5Fixed in 1:7.2+dfsg-7+deb12u18Fixed in 1:7.2+dfsg-7+deb12u15Fixed in 1:10.0.7+ds-0+deb13u1Fixed in 1:10.0.2+ds-2+deb13u1Fixed in 1:10.2.1+ds-1
Upgrade
Upgrade QEMU to a version that resolves this vulnerability.
Patch 6bf21f3d83e95bcc4ba35a7a07cc6655e8b010b0

Event History

Sep 17, 2019

CVE Published

12:00 AM

Mar 5, 2020

CVE Published

via MITRE·06:27 PM

Data Sourced

via MITRE·06:27 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2019-20382?