update: qemu

[vbatts]

Name: qemu CVEs: ~CVE-2023-0330~, CVE-2023-1544, ~CVE-2023-2861~ CVSSs: 6.0, 6.3, 6.3 Action Needed: ~update to >= 8.0.0 for CVE-2023-0330~, update to > 7.2.0 for CVE-2023-1544, ~update to >= 8.0.0 for CVE-2023-2861~

Summary:

• ~CVE-2023-0330: A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.~
• CVE-2023-1544: A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.
• ~CVE-2023-2861: Insufficient access control in 9pfs~

Qemu is only in Flatcar SDK, not critical.

Gentoo ebuild for 8.0.2 is available.

refmap.gentoo: https://bugs.gentoo.org/905342, https://bugs.gentoo.org/909542

[krnowak]

CVE-2023-0330 and CVE-2023-2861 are fixed in next alpha. CVE-2023-1544 is still TBD.

[sayanchowdhury]

Updated info for CVE-2023-1544, update to > 7.2.0

@dongsupark can you just confirm once if the info is correct. ^^

[dongsupark]

@sayanchowdhury Yes, correct. Thanks.

[krnowak]

If this is correct, then this can be closed, we have 8.0.3 (8.0.4 if the weekly comes in).

[dongsupark]

Right, let's close