CVE 2022-2962
A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possibly leading to a stack or heap overflow. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
Related bugs and status
CVE-2022-2962 (Candidate) is related to these bugs:
Bug #1853307: [22.04 FEAT] Enhanced Interpretation for PCI Functions - qemu part
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1853307 | [22.04 FEAT] Enhanced Interpretation for PCI Functions - qemu part | qemu (Ubuntu) | Undecided | Fix Released | ||
1853307 | [22.04 FEAT] Enhanced Interpretation for PCI Functions - qemu part | Ubuntu on IBM z Systems | Medium | Fix Released | ||
1853307 | [22.04 FEAT] Enhanced Interpretation for PCI Functions - qemu part | qemu (Ubuntu Lunar) | Undecided | Fix Released | ||
1853307 | [22.04 FEAT] Enhanced Interpretation for PCI Functions - qemu part | qemu (Ubuntu Kinetic) | Undecided | Won't Fix | ||
1853307 | [22.04 FEAT] Enhanced Interpretation for PCI Functions - qemu part | qemu (Ubuntu Jammy) | Undecided | Fix Released |
Bug #1957924: rpc-worker: debugfs access is restricted
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1957924 | rpc-worker: debugfs access is restricted | libvirt (Ubuntu) | Undecided | Fix Released | ||
1957924 | rpc-worker: debugfs access is restricted | libvirt | Unknown | Fix Released | ||
1957924 | rpc-worker: debugfs access is restricted | qemu (Ubuntu) | Undecided | Fix Released |
Bug #1959966: [23.04 FEAT] KVM: Secure Execution guest dump encryption with customer keys - qemu part
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1959966 | [23.04 FEAT] KVM: Secure Execution guest dump encryption with customer keys - qemu part | qemu (Ubuntu) | High | Fix Released | ||
1959966 | [23.04 FEAT] KVM: Secure Execution guest dump encryption with customer keys - qemu part | Ubuntu on IBM z Systems | High | Fix Released |
Bug #1988704: Consider adding further qemu modules that depend on universe
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1988704 | Consider adding further qemu modules that depend on universe | qemu (Ubuntu) | Medium | Fix Released |
Bug #1993438: Merge qemu from Debian unstable for l-series
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1993438 | Merge qemu from Debian unstable for l-series | qemu (Ubuntu) | Undecided | Fix Released |
Bug #1999885: [UBUNTU 20.04] KVM: s390: pv: don't allow userspace to set the clock under PV - qemu part
Summary | In | Importance | Status | |||
---|---|---|---|---|---|---|
1999885 | [UBUNTU 20.04] KVM: s390: pv: don't allow userspace to set the clock under PV - qemu part | qemu (Ubuntu) | Low | Fix Released | ||
1999885 | [UBUNTU 20.04] KVM: s390: pv: don't allow userspace to set the clock under PV - qemu part | Ubuntu on IBM z Systems | High | Fix Released | ||
1999885 | [UBUNTU 20.04] KVM: s390: pv: don't allow userspace to set the clock under PV - qemu part | qemu (Ubuntu Lunar) | Low | Fix Released | ||
1999885 | [UBUNTU 20.04] KVM: s390: pv: don't allow userspace to set the clock under PV - qemu part | qemu (Ubuntu Jammy) | Undecided | Fix Released | ||
1999885 | [UBUNTU 20.04] KVM: s390: pv: don't allow userspace to set the clock under PV - qemu part | qemu (Ubuntu Focal) | Undecided | Fix Released | ||
1999885 | [UBUNTU 20.04] KVM: s390: pv: don't allow userspace to set the clock under PV - qemu part | qemu (Ubuntu Kinetic) | Undecided | Fix Released |
See the
CVE page on Mitre.org
for more details.