Bug 1997184 (CVE-2021-3735)

Summary:	CVE-2021-3735 QEMU: ahci: deadlock issue leads to denial of service
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	berrange, carnil, cfergeau, crobinso, dbecker, jen, jferlan, jforbes, jjoyce, jmaloy, jschluet, jsnow, knoel, lhh, lkundrak, lpeer, m.a.young, mburns, mkenneth, mrezanin, mst, ondrejj, pbonzini, rjones, sclewis, slinaber, virt-maint, virt-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. A privileged user inside the guest could use this flaw to hang the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1997213, 1997214, 1997215, 1997216, 1997217, 1997218
Bug Blocks:	1981414

Description Mauro Matteo Cascella 2021-08-24 14:59:07 UTC

A deadlock issue was found in the AHCI controller device (ich9-ahci) of QEMU while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. The bug is triggered on a software reset (ahci_reset_port) in the handle_reg_h2d_fis() function [1]. A privileged user inside the guest could use this flaw to hang the QEMU process on the host, resulting in a denial of service condition.

[1] https://github.com/qemu/qemu/blob/v6.1.0-rc4/hw/ide/ahci.c#L1215

Comment 2 Mauro Matteo Cascella 2021-08-24 16:05:53 UTC

Created qemu tracking bugs for this issue:

Affects: epel-7 [bug 1997217]
Affects: fedora-all [bug 1997215]

Comment 4 Salvatore Bonaccorso 2021-09-03 13:12:36 UTC

Has this issue been forwarde/notified to upstream?

Comment 5 Mauro Matteo Cascella 2021-09-03 16:38:39 UTC

In reply to comment #4:
> Has this issue been forwarde/notified to upstream?

Yes, this was reported via qemu-security mailing list. John Snow (IDE maintainer) is aware of it. John, do you happen to have any updates on this?