Laszlo Ersek

A flaw was found in the Linux kernel's TUN/TAP functionality, which could allow a local user to bypass network filters and gain unauthorized access to some resources. The issue is related to the incorrect initialization of the socket UID in the `tun chr open()` and `tap open()` functions. This could potentially allow an attacker to impact data integrity or elevate their privileges.

A flaw was found in the get keys() function, specifically when calculating the greatest possible number of matching keys. This issue can lead to a denial of service, which could be caused by either a mistake or a malicious actor.

Name of the Vulnerable Software and Affected Versions: libslirp version 4.1.0 QEMU version 4.2.0 Description: The issue is related to a component of the Libslirp TCP-IP emulator, specifically the tcp subr.c library, which has an insufficient mechanism for checking the size of copied data. This allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem arises from the misuse of snprintf return values in the tcp subr.c file, leading to a buffer overflow in later code. Recommendations: For libslirp version 4.1.0, consider updating to a newer version that addresses the buffer overflow issue in the tcp subr.c library. For QEMU version 4.2.0, update to a version that includes the fix for the libslirp component to prevent exploitation of the buffer overflow vulnerability. As a temporary workaround, consider restricting access to the tcp subr.c component until a patch is available.

The issue is related to an infinite loop that could occur while processing data via transmit or receive descriptors in QEMU, specifically when the initial receive/transmit descriptor head is set outside the allocated descriptor buffer. A privileged user inside a guest could exploit this to crash the QEMU instance, resulting in a denial of service.

The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotely. In QEMU, the VGA emulator allows local guest users to read host memory by setting the display to a high resolution.

The issue concerns the qemu guest agent in Qemu, which is used by Xen. When the agent is started in daemon mode, it utilizes weak permissions for certain files. This weakness allows local users to read and write to these files.