{"schema_version":"1.7.5","id":"SUSE-SU-2025:20011-1","published":"2025-02-03T08:47:27Z","modified":"2026-03-23T04:47:06.565245Z","related":["CVE-2024-26328","CVE-2024-3446","CVE-2024-3447","CVE-2024-3567"],"upstream":["CVE-2024-26328","CVE-2024-3446","CVE-2024-3447","CVE-2024-3567"],"summary":"Security update for qemu","details":"This update for qemu fixes the following issues:\n\n- Update to version 8.2.5:\n  * target/loongarch: fix a wrong print in cpu dump\n  * ui/sdl2: Allow host to power down screen\n  * target/i386: fix SSE and SSE2 feature check\n  * target/i386: fix xsave.flat from kvm-unit-tests\n  * disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs\n  * target/riscv/kvm.c: Fix the hart bit setting of AIA\n  * target/riscv: rvzicbo: Fixup CBO extension register calculation\n  * target/riscv: do not set mtval2 for non guest-page faults\n  * target/riscv: prioritize pmp errors in raise_mmu_exception()\n  * target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions\n  * target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w\n  * target/riscv: rvv: Check single width operator for vector fp widen instructions\n  * target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions\n  * target/riscv/cpu.c: fix Zvkb extension config\n  * target/riscv: Fix the element agnostic function problem\n  * target/riscv/kvm: tolerate KVM disable ext errors\n  * hw/intc/riscv_aplic: APLICs should add child earlier than realize\n  * iotests: test NBD+TLS+iothread\n  * qio: Inherit follow_coroutine_ctx across TLS\n  * target/arm: Disable SVE extensions when SVE is disabled\n  * hw/intc/arm_gic: Fix handling of NS view of GICC_APR<n>\n  * hvf: arm: Fix encodings for ID_AA64PFR1_EL1 and debug System registers\n  * gitlab: use 'setarch -R' to workaround tsan bug\n  * gitlab: use $MAKE instead of 'make'\n  * dockerfiles: add 'MAKE' env variable to remaining containers\n  * gitlab: Update msys2-64bit runner tags\n  * target/i386: no single-step exception after MOV or POP SS\n\n- Update to version 8.2.4.\n  * target/sh4: Fix SUBV opcode\n  * target/sh4: Fix ADDV opcode\n  * hw/arm/npcm7xx: Store derivative OTP fuse key in little endian\n  * hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields\n  * hw/ufs: Fix buffer overflow bug\n  * tests/avocado: update sunxi kernel from armbian to 6.6.16\n  * target/loongarch/cpu.c: typo fix: expection\n  * backends/cryptodev-builtin: Fix local_error leaks\n  * nbd/server: Mark negotiation functions as coroutine_fn\n  * nbd/server: do not poll within a coroutine context\n  * linux-user: do_setsockopt: fix SOL_ALG.ALG_SET_KEY\n  * target/riscv/kvm: change timer regs size to u64\n  * target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64\n  * target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32\n\n- Update to version 8.2.3.\n  * Update version for 8.2.3 release\n  * ppc/spapr: Initialize max_cpus limit to SPAPR_IRQ_NR_IPIS.\n  * ppc/spapr: Introduce SPAPR_IRQ_NR_IPIS to refer IRQ range for CPU IPIs.\n  * hw/pci-host/ppc440_pcix: Do not expose a bridge device on PCI bus\n  * hw/isa/vt82c686: Keep track of PIRQ/PINT pins separately\n  * virtio-pci: fix use of a released vector\n  * linux-user/x86_64: Handle the vsyscall page in open_self_maps_{2,4}\n  * hw/audio/virtio-snd: Remove unused assignment\n  * hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()\n  * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set\n  * hw/net/lan9118: Fix overflow in MIL TX FIFO\n  * hw/net/lan9118: Replace magic '2048' value by MIL_TXFIFO_SIZE definition\n  * backends/cryptodev: Do not abort for invalid session ID\n  * hw/misc/applesmc: Fix memory leak in reset() handler\n  * hw/block/nand: Fix out-of-bound access in NAND block buffer\n  * hw/block/nand: Have blk_load() take unsigned offset and return boolean\n  * hw/block/nand: Factor nand_load_iolen() method out\n  * qemu-options: Fix CXL Fixed Memory Window interleave-granularity typo\n  * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs\n  * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs\n  * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs\n  * mirror: Don't call job_pause_point() under graph lock (bsc#1224179)\n\n- Backports and bugfixes:\n  * hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum() (bsc#1222841, CVE-2024-3567)\n  * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446)\n  * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446)\n  * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446)\n  * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446)\n  * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447)\n  * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328)\n\n- Update to version 8.2.2\n  * chardev/char-socket: Fix TLS io channels sending too much data to the backend\n  * tests/unit/test-util-sockets: Remove temporary file after test\n  * hw/usb/bus.c: PCAP adding 0xA in Windows version\n  * hw/intc/Kconfig: Fix GIC settings when using \"--without-default-devices\"\n  * gitlab: force allow use of pip in Cirrus jobs\n  * tests/vm: avoid re-building the VM images all the time\n  * tests/vm: update openbsd image to 7.4\n  * target/i386: leave the A20 bit set in the final NPT walk\n  * target/i386: remove unnecessary/wrong application of the A20 mask\n  * target/i386: Fix physical address truncation\n  * target/i386: check validity of VMCB addresses\n  * target/i386: mask high bits of CR3 in 32-bit mode\n  * pl031: Update last RTCLR value on write in case it's read back\n  * hw/nvme: fix invalid endian conversion\n  * update edk2 binaries to edk2-stable202402\n  * update edk2 submodule to edk2-stable202402\n  * target/ppc: Fix crash on machine check caused by ifetch\n  * target/ppc: Fix lxv/stxv MSR facility check\n  * .gitlab-ci.d/windows.yml: Drop msys2-32bit job\n  * system/vl: Update description for input grab key\n  * docs/system: Update description for input grab key\n  * hw/hppa/Kconfig: Fix building with \"configure --without-default-devices\"\n  * tests/qtest: Depend on dbus_display1_dep\n  * meson: Explicitly specify dbus-display1.h dependency\n  * audio: Depend on dbus_display1_dep\n  * ui/console: Fix console resize with placeholder surface\n  * ui/clipboard: add asserts for update and request\n  * ui/clipboard: mark type as not available when there is no data\n  * ui: reject extended clipboard message if not activated\n  * target/i386: Generate an illegal opcode exception on cmp instructions with lock prefix\n  * i386/cpuid: Move leaf 7 to correct group\n  * i386/cpuid: Decrease cpuid_i when skipping CPUID leaf 1F\n  * i386/cpu: Mask with XCR0/XSS mask for FEAT_XSAVE_XCR0_HI and FEAT_XSAVE_XSS_HI leafs\n  * i386/cpu: Clear FEAT_XSAVE_XSS_LO/HI leafs when CPUID_EXT_XSAVE is not available\n  * .gitlab-ci/windows.yml: Don't install libusb or spice packages on 32-bit\n  * iotests: Make 144 deterministic again\n  * target/arm: Don't get MDCR_EL2 in pmu_counter_enabled() before checking ARM_FEATURE_PMU\n  * target/arm: Fix SVE/SME gross MTE suppression checks\n  * target/arm: Handle mte in do_ldrq, do_ldro\n- Address bsc#1220310. Backported upstream commits:\n  * ppc/spapr: Initialize max_cpus limit to SPAPR_IRQ_NR_IPIS\n  * ppc/spapr: Introduce SPAPR_IRQ_NR_IPIS to refer IRQ range for CPU IPIs.\n","affected":[{"package":{"name":"qemu","ecosystem":"SUSE:Linux Micro 6.0","purl":"pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Micro%206.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.5-1.1"}]}],"ecosystem_specific":{"binaries":[{"qemu":"8.2.5-1.1","qemu-accel-tcg-x86":"8.2.5-1.1","qemu-arm":"8.2.5-1.1","qemu-audio-spice":"8.2.5-1.1","qemu-block-curl":"8.2.5-1.1","qemu-block-iscsi":"8.2.5-1.1","qemu-block-rbd":"8.2.5-1.1","qemu-block-ssh":"8.2.5-1.1","qemu-chardev-spice":"8.2.5-1.1","qemu-guest-agent":"8.2.5-1.1","qemu-hw-display-qxl":"8.2.5-1.1","qemu-hw-display-virtio-gpu":"8.2.5-1.1","qemu-hw-display-virtio-gpu-pci":"8.2.5-1.1","qemu-hw-display-virtio-vga":"8.2.5-1.1","qemu-hw-usb-host":"8.2.5-1.1","qemu-hw-usb-redirect":"8.2.5-1.1","qemu-img":"8.2.5-1.1","qemu-ipxe":"8.2.5-1.1","qemu-ksm":"8.2.5-1.1","qemu-lang":"8.2.5-1.1","qemu-pr-helper":"8.2.5-1.1","qemu-s390x":"8.2.5-1.1","qemu-seabios":"8.2.51.16.3_3_ga95067eb-1.1","qemu-tools":"8.2.5-1.1","qemu-ui-opengl":"8.2.5-1.1","qemu-ui-spice-core":"8.2.5-1.1","qemu-vgabios":"8.2.51.16.3_3_ga95067eb-1.1","qemu-x86":"8.2.5-1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:20011-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520011-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1084909"},{"type":"REPORT","url":"https://bugzilla.suse.com/1220065"},{"type":"REPORT","url":"https://bugzilla.suse.com/1220310"},{"type":"REPORT","url":"https://bugzilla.suse.com/1222218"},{"type":"REPORT","url":"https://bugzilla.suse.com/1222841"},{"type":"REPORT","url":"https://bugzilla.suse.com/1222843"},{"type":"REPORT","url":"https://bugzilla.suse.com/1222845"},{"type":"REPORT","url":"https://bugzilla.suse.com/1224179"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-26328"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-3446"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-3447"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-3567"}]}