A flaw was found in the ATI VGA emulation of QEMU. An inconsistent check and use of dst[x|y] and s->regs.dst[x|y] may lead to out-of-bounds write of vramptr. This flaw occurs in the ati2dblt() routine while handling MMIO write operations from the guest. A malicious guest user could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
Note: this is similar to CVE-2020-11869, CVE-2020-24352 and CVE-2020-27616.
An out-of-bound write access flaw was found in the way QEMU loads ROM contents at boot time. This flaw occurs in the romcopy() routine while loading the contents of a 32-bit -kernel image into memory. Running an untrusted -kernel image may load contents at arbitrary memory locations, potentially leading to code execution with the privileges of the QEMU process.
A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU.
hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space.
It was discovered that the Access Control List (ACL) implemented by qemu-bridge-helper program could be bypassed in particular cases when the bridge interface names are as long as IFNAMSIZ-1, ie 15 characters. If the ACL specified in the /etc/qemu-kvm/bridge.conf file denies access to a bridge interface with a name long IFNAMSIZ-1, but it allows all other interfaces, it is possible for a local attacker to use qemu-bridge-helper to create a tap device and attach it to a denied bridge interface, thus bypassing the ACL. This could be used by the attacker to get access to confidential data transmitted on the bridge.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg00245.html
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/07/02/2
A null pointer dereference issue was found the QXL VGA card emulator of QEMU. It could occur while releasing resources allocated for a SPICE server thread in interfacereleaseresources().
A guest user could use this flaw to crash the QEMU process resulting in DoS scenario.
Upstream patch: --------------- -> https://git.qemu.org/?p=qemu.git;a=commit;h=d52680fc932efb8a2f334cc6993e705ed1e31e99
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/05/22/1