REDHAT-BUG-2313497: Low severity qemu vulnerability
An assertion failure was found in QEMU in the usbepget() function in hw/net/core.c. The TD PID needs to be either USBTOKENIN or USBTOKENOUT in usbepget, but in the caller uhcihandletd it may be USBTOKENSETUP.
An unprivileged guest user may be able to reach the assertion. Users are not directly able to craft URBs, however as a user, one might be able to find a kernel path that would send a TD with PID USBTOKENSETUP to QEMU (which is called USBPIDSETUP in Linux). For instance in the Linux Kernel, uhcisubmitcontrol in drivers/usb/host/uhci-q.c:789 does link a USBPIDSETUP TD to the URB.
Upstream issue: https://gitlab.com/qemu-project/qemu/-/issues/2548
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2313497?
The severity of REDHAT-BUG-2313497 is considered high due to the potential for unprivileged guest users to trigger assertion failures.
How do I fix REDHAT-BUG-2313497?
To fix REDHAT-BUG-2313497, you should update QEMU to the latest version where the bug has been addressed.
What impact does REDHAT-BUG-2313497 have on my system?
REDHAT-BUG-2313497 can lead to instability in QEMU environments, which may affect guest operations.
Is REDHAT-BUG-2313497 related to a specific version of QEMU?
REDHAT-BUG-2313497 is not tied to a specific version of QEMU but affects multiple versions where the assertion failure occurs.
Are there any workarounds for REDHAT-BUG-2313497?
There are no documented workarounds for REDHAT-BUG-2313497; the recommended action is to apply updates.