Withdrawn by the publisher.

A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU.

A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU.

QEMU: Slirp: use-after-free during packet reassembly QEMU: slirp: use-after-free in ip_reass() function in ip_input.c qemu: weak signature generation in Pointer Authentication support for ARM QEMU: virtiofsd: guest may open maximum file descriptor to cause DoS QEMU: nbd: reachable assertion failure in nbd_negotiate_send_rep_verr via remote client libvirt: leak of sensitive cookie information via dumpxml luajit: out-of-bounds read because __gc handler frame traversal is mishandled

Affected: Ubuntu:20.04:LTS: qemu

A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all programs running on QEMU.

Ein lokaler Angreifer kann eine Schwachstelle in QEMU ausnutzen, um Sicherheitsvorkehrungen zu umgehen.