ESB-2018.3698 - [SUSE] qemu: Multiple vulnerabilities 2018-11-28

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.3698
              SUSE Security Update: Security update for qemu
                             28 November 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           qemu
Publisher:         SUSE
Operating System:  SUSE
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Increased Privileges            -- Existing Account      
                   Denial of Service               -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-18849 CVE-2018-17963 CVE-2018-17962
                   CVE-2018-17958 CVE-2018-16847 CVE-2018-15746
                   CVE-2018-10839  

Reference:         ESB-2018.3670
                   ESB-2018.3660
                   ESB-2018.3533
                   ESB-2018.3255

Original Bulletin: 
   https://www.suse.com/support/update/announcement/2018/suse-su-20183927-1/

- --------------------------BEGIN INCLUDED TEXT--------------------

   SUSE Security Update: Security update for qemu
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:3927-1
Rating:             important
References:         #1106222 #1107489 #1110910 #1111006 #1111010 
                    #1111013 #1112499 #1114422 #1114529 
Cross-References:   CVE-2018-10839 CVE-2018-15746 CVE-2018-16847
                    CVE-2018-17958 CVE-2018-17962 CVE-2018-17963
                    CVE-2018-18849
Affected Products:
                    SUSE Linux Enterprise Module for Server Applications 15
                    SUSE Linux Enterprise Module for Open Buildservice Development Tools 15
                    SUSE Linux Enterprise Module for Basesystem 15
______________________________________________________________________________

   An update that solves 7 vulnerabilities and has two fixes
   is now available.

Description:

   This update for qemu fixes the following issues:

   Security issues fixed:

   - CVE-2018-10839: Fixed NE2000 NIC emulation support that is vulnerable to
     an integer overflow, which could lead to buffer overflow issue. It could
     occur when receiving packets over the network. A user inside guest could
     use this flaw to crash the Qemu process resulting in DoS (bsc#1110910).
   - CVE-2018-15746: Fixed qemu-seccomp.c that might allow local OS guest
     users to cause a denial of service (guest crash) by leveraging
     mishandling of the seccomp policy for threads other than the main thread
     (bsc#1106222).
   - CVE-2018-16847: Fixed an OOB heap buffer r/w access issue that was found
     in the NVM Express Controller emulation in QEMU. It could occur in
     nvme_cmb_ops routines in nvme device. A guest user/process could use
     this flaw to crash the QEMU process resulting in DoS or potentially run
     arbitrary code with privileges of the QEMU process (bsc#1114529).
   - CVE-2018-17958: Fixed a Buffer Overflow in rtl8139_do_receive in
     hw/net/rtl8139.c because an incorrect integer data type is used
     (bsc#1111006).
   - CVE-2018-17962: Fixed a Buffer Overflow in pcnet_receive in
     hw/net/pcnet.c because an incorrect integer data type is used
     (bsc#1111010).
   - CVE-2018-17963: Fixed qemu_deliver_packet_iov in net/net.c that accepts
     packet sizes greater than INT_MAX, which allows attackers to cause a
     denial of service or possibly have unspecified other impact.
     (bsc#1111013)
   - CVE-2018-18849: Fixed an out of bounds memory access issue that was
     found in the LSI53C895A SCSI Host Bus Adapter emulation while writing a
     message in lsi_do_msgin. It could occur during migration if the
     'msg_len' field has an invalid value. A user/process could use this flaw
     to crash the Qemu process resulting in DoS (bsc#1114422).

   Non-security issues fixed:

   - Fix slowness in arm32 emulation (bsc#1112499).
   - In order to improve spectre mitigation for s390x, add a new feature in
     the QEMU cpu model to provide the etoken cpu feature for guests
     (bsc#1107489).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Server Applications 15:

      zypper in -t patch SUSE-SLE-Module-Server-Applications-15-2018-2794=1

   - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15:

      zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-2018-2794=1

   - SUSE Linux Enterprise Module for Basesystem 15:

      zypper in -t patch SUSE-SLE-Module-Basesystem-15-2018-2794=1



Package List:

   - SUSE Linux Enterprise Module for Server Applications 15 (aarch64 ppc64le s390x x86_64):

      qemu-2.11.2-9.12.2
      qemu-block-curl-2.11.2-9.12.2
      qemu-block-curl-debuginfo-2.11.2-9.12.2
      qemu-block-iscsi-2.11.2-9.12.2
      qemu-block-iscsi-debuginfo-2.11.2-9.12.2
      qemu-block-rbd-2.11.2-9.12.2
      qemu-block-rbd-debuginfo-2.11.2-9.12.2
      qemu-block-ssh-2.11.2-9.12.2
      qemu-block-ssh-debuginfo-2.11.2-9.12.2
      qemu-debuginfo-2.11.2-9.12.2
      qemu-debugsource-2.11.2-9.12.2
      qemu-guest-agent-2.11.2-9.12.2
      qemu-guest-agent-debuginfo-2.11.2-9.12.2
      qemu-lang-2.11.2-9.12.2

   - SUSE Linux Enterprise Module for Server Applications 15 (s390x x86_64):

      qemu-kvm-2.11.2-9.12.2

   - SUSE Linux Enterprise Module for Server Applications 15 (aarch64):

      qemu-arm-2.11.2-9.12.2
      qemu-arm-debuginfo-2.11.2-9.12.2

   - SUSE Linux Enterprise Module for Server Applications 15 (ppc64le):

      qemu-ppc-2.11.2-9.12.2
      qemu-ppc-debuginfo-2.11.2-9.12.2

   - SUSE Linux Enterprise Module for Server Applications 15 (x86_64):

      qemu-x86-2.11.2-9.12.2
      qemu-x86-debuginfo-2.11.2-9.12.2

   - SUSE Linux Enterprise Module for Server Applications 15 (noarch):

      qemu-ipxe-1.0.0+-9.12.2
      qemu-seabios-1.11.0-9.12.2
      qemu-sgabios-8-9.12.2
      qemu-vgabios-1.11.0-9.12.2

   - SUSE Linux Enterprise Module for Server Applications 15 (s390x):

      qemu-s390-2.11.2-9.12.2
      qemu-s390-debuginfo-2.11.2-9.12.2

   - SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (aarch64 ppc64le s390x x86_64):

      qemu-block-dmg-2.11.2-9.12.2
      qemu-block-dmg-debuginfo-2.11.2-9.12.2
      qemu-debuginfo-2.11.2-9.12.2
      qemu-debugsource-2.11.2-9.12.2
      qemu-extra-2.11.2-9.12.2
      qemu-extra-debuginfo-2.11.2-9.12.2
      qemu-linux-user-2.11.2-9.12.1
      qemu-linux-user-debuginfo-2.11.2-9.12.1
      qemu-linux-user-debugsource-2.11.2-9.12.1

   - SUSE Linux Enterprise Module for Basesystem 15 (aarch64 ppc64le s390x x86_64):

      qemu-debuginfo-2.11.2-9.12.2
      qemu-debugsource-2.11.2-9.12.2
      qemu-tools-2.11.2-9.12.2
      qemu-tools-debuginfo-2.11.2-9.12.2


References:

   https://www.suse.com/security/cve/CVE-2018-10839.html
   https://www.suse.com/security/cve/CVE-2018-15746.html
   https://www.suse.com/security/cve/CVE-2018-16847.html
   https://www.suse.com/security/cve/CVE-2018-17958.html
   https://www.suse.com/security/cve/CVE-2018-17962.html
   https://www.suse.com/security/cve/CVE-2018-17963.html
   https://www.suse.com/security/cve/CVE-2018-18849.html
   https://bugzilla.suse.com/1106222
   https://bugzilla.suse.com/1107489
   https://bugzilla.suse.com/1110910
   https://bugzilla.suse.com/1111006
   https://bugzilla.suse.com/1111010
   https://bugzilla.suse.com/1111013
   https://bugzilla.suse.com/1112499
   https://bugzilla.suse.com/1114422
   https://bugzilla.suse.com/1114529

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBW/4jfGaOgq3Tt24GAQh7+g//QKorx4V/Tq2KlKFgQDxcmAiHNGltoVKX
e5VM1QkljZiasON/Hldui2c/jluM8344fbUcB9UcHsze1SUpVpZrIKygd28aRoJy
yF4XTXMR/LeLu5xthW9VqDYd/ZelO/C/K3+K0HSgqiTUxAh26Fzhk4QWjXZSkrbO
M5NEaGt5T7xCblGsz3jLxh9iQBaZfpOT9gzahUil6z4T5TsIhV0uW3zSIK+0rrYd
yy/rzvlmArJvJD//SoZMOYfTsuN09VI/tDuUn3yXSyvfrKTwwTvhwB21PK71O+nG
86vg9qeUmiv/9paf16hxsGPZRzMSqCvhar2gfcB+JOSENolcc8RKiScGu94U1JF+
Is6p6bzNhCf1wj0FoejnztFUiR9ULelTb1EXWvvvqrwmEaEp+uhKwlogQNOXIL0U
O2cvTKIPEVyyGTR535D2dsEIFMi38SzWHVMovIrCbYOK2sN8oSMv2WHRs88l0l86
W5L6Sd8IprpZJV5lYIgA1oyAI/yOuOmDKEjkt4fau6hVPwUgHwS1DFBF7shZc+qC
kWwJXhN3CeRI2nDSgYjQQyv/gU+7j8OBEwLOYY0sx0ZXLHLiOuk7Wh49KFej0PHP
43mC7f5H7S/sP3/fxv1e1YSA84Q7eIgW8VSAOGw06VPCNHRhsbTHIGjyv/jdaFDO
bwprrRy4CTY=
=UHcN
-----END PGP SIGNATURE-----

« Back to bulletins