Prasad Pandit

A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error in the `mptsas free request()` function that does not dequeue the request object `req` from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.

Name of the Vulnerable Software and Affected Versions: virt-manager version 2.2.0 Description: The virt-install utility has introduced an option '--unattended' to create virtual machines without user interaction. This option accepts the guest VM password as command line arguments, potentially leaking them to other users on the system via process listing. Recommendations: For virt-manager version 2.2.0, consider avoiding the use of the '--unattended' option until a secure alternative is available, or restrict access to process listings to minimize the risk of password exposure.

The issue is related to an improper access control problem in Qemu when built with VirtFS and 9pfs support. This could allow a privileged user inside a guest to access the host file system beyond the shared folder, potentially escalating their privileges on the host.

The issue is related to a memory leak in the `sdhci sdma transfer multi blocks` function in `hw/sd/sdhci.c` of the QEMU emulator. This can be exploited by a local attacker to cause a denial of service or execute arbitrary code on the QEMU host. The exploitation involves vectors related to the data transfer length, potentially leading to out-of-bounds heap access and crash.

A heap buffer overflow issue was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support. The issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. This could allow a privileged user/process inside a guest to crash the QEMU process or potentially execute arbitrary code on the host with privileges of the QEMU process.

A heap-based buffer overflow issue exists in the iscsi aio ioctl function in block/iscsi.c, allowing local guest OS users to cause a denial of service, potentially leading to a QEMU process crash, or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.

The issue allows local guest OS users to cause a denial of service, resulting in a process crash. This occurs when an entropy request is made, triggering arbitrary stack-based allocation and memory corruption.

The issue allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack." This occurs because the prepend path function in fs/dcache.c does not properly handle rename actions inside a bind mount.

The issue is related to the ` driver rfc4106 decrypt` function in the Linux kernel, which does not properly determine the memory locations used for encrypted data. This allows attackers to cause a denial of service, such as a buffer overflow and system crash, or possibly execute arbitrary code by triggering a crypto API call.

The issue is related to the `usbip recv xbuff` function in the Linux kernel, which can be exploited by remote attackers to cause a denial of service (out-of-bounds write) or possibly have other unspecified impacts. This is achieved by sending a crafted length value in a USB/IP packet.

The issue is related to the `futex wait requeue pi` function in the Linux kernel, which does not properly validate futex addresses. This can be exploited by local users to cause a denial of service, resulting in a NULL pointer dereference and system crash, or potentially have other unspecified impacts through a crafted FUTEX WAIT REQUEUE PI command.

The issue is related to the fib6 add function in the Linux kernel, which does not properly implement error-code encoding. This allows local users with the CAP NET ADMIN capability to cause a denial of service, resulting in a NULL pointer dereference and system crash, by making an IPv6 SIOCADDRT ioctl call.

The issue allows local users to bypass intended access restrictions via a crafted ioctl call due to the lack of privilege level checking in the `aac compat ioctl` function. This could potentially lead to privilege escalation.

The issue is related to a use-after-free vulnerability in the Linux kernel, specifically in the drivers/net/tun.c file. This vulnerability can be exploited by local users to gain privileges, provided they have the CAP NET ADMIN capability. The exploitation involves providing an invalid tuntap interface name in a TUNSETIFF ioctl call.

The issue allows local users to cause a denial of service, resulting in a system crash. This occurs via vectors involving an attempted register access that triggers an unexpected value in the Exception Syndrome Register (ESR), specifically through the bad mode function in arch/arm64/kernel/traps.c on the ARM64 platform.

The issue concerns the key notify policy flush function in the Linux kernel, which fails to initialize a certain structure member. This allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify policy interface of an IPSec key socket.

The issue affects the Linux kernel, where the `key notify sa flush` and `key notify policy flush` functions in `net/key/af key.c` do not properly initialize certain structure members. This allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key socket.

The issue allows local users to cause a denial of service, resulting in an invalid free operation and system crash, or possibly gain privileges. This is achieved via a sendmsg system call with the `IP RETOPTS` option.

The issue allows local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning CD-ROM drive. This is due to a problem in the mmc ioctl cdrom read data function in drivers/cdrom/cdrom.c.

The issue concerns the `fill event metadata` function in `fs/notify/fanotify/fanotify user.c`, which fails to initialize a certain structure member. This allows local users to obtain sensitive information from kernel memory via a read operation on the `fanotify` descriptor.