Description
A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is invoked. The function allocates a heap buffer without zeroing the memory, leaving the buffer filled with residual data from prior allocations. When the guest later reads from register UEFI_VARS_REG_PIO_BUFFER_TRANSFER, the .read callback `uefi_vars_read` returns leftover metadata or other sensitive process memory from the previously allocated buffer, leading to an information disclosure vulnerability.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
qemu
Default version status: unaffected
10.0.0 to < 10.1.0affected
Red Hat Red Hat Enterprise Linux 10
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 6
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 7
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 7
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 8
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 8 Advanced Virtualization
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 8 Advanced Virtualization
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 9
Default version status: unaffected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: unaffected