REDHAT-BUG-2313760: Low severity qemu vulnerability
A flaw was found in QEMU in the virtio-scsi, virtio-blk and virtio-crypto devices. The size for virtqueuepush as set in virtioscsicompletereq / virtioblkreqcomplete / viritocryptoreqcomplete could be larger than the true size of the data which has been sent to guest.
Once virtqueuepush() finally calls dmamemoryunmap to ummap the iniov, it may call the addressspacewrite function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.
Upstream fix: https://gitlab.com/qemu-project/qemu/-/commit/637b0aa139565cb82a7b9269e62214f87082635c
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2313760?
The severity of REDHAT-BUG-2313760 is considered high due to potential data integrity issues.
How do I fix REDHAT-BUG-2313760?
To fix REDHAT-BUG-2313760, users should update to the latest version of QEMU that contains the patch addressing this vulnerability.
What components are affected by REDHAT-BUG-2313760?
REDHAT-BUG-2313760 affects the virtio-scsi, virtio-blk, and virtio-crypto devices in QEMU.
Can REDHAT-BUG-2313760 lead to a denial of service?
Yes, REDHAT-BUG-2313760 could potentially lead to denial of service due to incorrect handling of data sizes.
What environments are impacted by REDHAT-BUG-2313760?
REDHAT-BUG-2313760 impacts environments utilizing QEMU virtualization technology with the affected virtio devices.