Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.2937
ovmf security and enhancement update
7 August 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: ovmf
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 7
Impact/Access: Increased Privileges -- Existing Account
Access Privileged Data -- Existing Account
Denial of Service -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2019-0161 CVE-2019-0160 CVE-2018-12181
CVE-2018-5407 CVE-2018-3613 CVE-2017-5735
CVE-2017-5734 CVE-2017-5733 CVE-2017-5732
CVE-2017-5731
Reference: ESB-2019.2173
ESB-2018.3932
ESB-2018.3545
Original Bulletin:
https://access.redhat.com/errata/RHSA-2019:2125
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: ovmf security and enhancement update
Advisory ID: RHSA-2019:2125-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2019:2125
Issue date: 2019-08-06
CVE Names: CVE-2017-5731 CVE-2017-5732 CVE-2017-5733
CVE-2017-5734 CVE-2017-5735 CVE-2018-3613
CVE-2018-5407 CVE-2018-12181 CVE-2019-0160
CVE-2019-0161
=====================================================================
1. Summary:
An update for ovmf is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Server (v. 7) - noarch
3. Description:
OVMF (Open Virtual Machine Firmware) is a project to enable UEFI support
for Virtual Machines. This package contains a sample 64-bit UEFI firmware
for QEMU and KVM.
Security Fix(es):
* edk2: Privilege escalation via processing of malformed files in
TianoCompress.c (CVE-2017-5731)
* edk2: Privilege escalation via processing of malformed files in
BaseUefiDecompressLib.c (CVE-2017-5732)
* edk2: Privilege escalation via heap-based buffer overflow in MakeTable()
function (CVE-2017-5733)
* edk2: Privilege escalation via stack-based buffer overflow in MakeTable()
function (CVE-2017-5734)
* edk2: Privilege escalation via heap-based buffer overflow in Decode()
function (CVE-2017-5735)
* edk2: Logic error in MdeModulePkg in EDK II firmware allows for privilege
escalation by authenticated users (CVE-2018-3613)
* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures
(PortSmash) (CVE-2018-5407)
* edk2: Stack buffer overflow with corrupted BMP (CVE-2018-12181)
* edk2: buffer overflows in PartitionDxe and UdfDxe with long file names
and invalid UDF media (CVE-2019-0160)
* edk2: stack overflow in XHCI causing denial of service (CVE-2019-0161)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.7 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1641433 - CVE-2018-3613 edk2: Logic error in MdeModulePkg in EDK II firmware allows for privilege escalation by authenticated users
1641442 - CVE-2017-5731 edk2: Privilege escalation via processing of malformed files in TianoCompress.c
1641446 - CVE-2017-5732 edk2: Privilege escalation via processing of malformed files in BaseUefiDecompressLib.c
1641450 - CVE-2017-5733 edk2: Privilege escalation via heap-based buffer overflow in MakeTable() function
1641458 - CVE-2017-5734 edk2: Privilege escalation via stack-based buffer overflow in MakeTable() function
1641465 - CVE-2017-5735 edk2: Privilege escalation via heap-based buffer overflow in Decode() function
1645695 - CVE-2018-5407 openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)
1686783 - CVE-2018-12181 edk2: Stack buffer overflow with corrupted BMP
1691640 - CVE-2019-0160 edk2: buffer overflows in PartitionDxe and UdfDxe with long file names and invalid UDF media
1694065 - CVE-2019-0161 edk2: stack overflow in XHCI causing denial of service
6. Package List:
Red Hat Enterprise Linux Server (v. 7):
Source:
ovmf-20180508-6.gitee3198e672e2.el7.src.rpm
noarch:
OVMF-20180508-6.gitee3198e672e2.el7.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2017-5731
https://access.redhat.com/security/cve/CVE-2017-5732
https://access.redhat.com/security/cve/CVE-2017-5733
https://access.redhat.com/security/cve/CVE-2017-5734
https://access.redhat.com/security/cve/CVE-2017-5735
https://access.redhat.com/security/cve/CVE-2018-3613
https://access.redhat.com/security/cve/CVE-2018-5407
https://access.redhat.com/security/cve/CVE-2018-12181
https://access.redhat.com/security/cve/CVE-2019-0160
https://access.redhat.com/security/cve/CVE-2019-0161
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXUl2ZNzjgjWX9erEAQhKuA/+O5K7BxvCHuj1pDM/pezYzjBfOcdVKQWz
L61IFKCy653XFNrw0fLFh8Er+/vkrlZD93rmGl9JqU4PmaeqO8Tofgw9d3XsuaI6
7hWuhyiYqjzkbRP+XZGQK3B8a8aY4a2uRMjNemo9nMjLTuEpkGWShxo6O0AGPuCG
GLhV6PTqAmNaxQSqEIdzzBk/YTVx+/ElEKEAYINfhyFV/KLAJcEso/v9DwA0vRaR
J0srktZqKHG0WZ8JUMGBT+iEfwsgWI/oZP2DdcUwALTtS8LiGsY6eUmhR6Hj7BBx
DDazP8ihme8q1Z3sTZVb+s2O4/v76bFexY6Q+k5SkS9/Xs8kYan8twTXo+r3d8Hy
AJBtCnUS8WQV3mXokvIjPtEWfzomcL0N2RYJlhFMFwO43LLUfBH2k7yq+4qQRPqC
KJI/I0lqckFDPJcW1T5CPhzPmixGchWoJpMzxNI4axznXg5SeyEX0Rd2czsuCUA0
wPXmrt6VBpEReROhjY0707Wyaq65BZws9+E7CoXDjvKiobQ/yHUVmv1GdUDeHpH5
dhOU+BMp38VwPORp/hX/cbm+FIZyPZWBKtOF/fuPJ3VV8xKNyGZ4Igcr9AdHT9O+
nHDfz2bu3595ZdZlUMw5wMb3pvtT48dT1NAgwsvTWgts/p9tg/JqoD3DJkHQaDiG
bSZXnvoCTGA=
=vpvG
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXUo3CmaOgq3Tt24GAQjW3A//SAxzWd5pvnBciVyQ+OHvTZKwzN12Az4P
9mFbtFlRXwDKnPdtICaOcoPfcgvRfHMsWn2OOP6a/QQGN8AfPE4JkVWoLQx9zMt8
FVQUfbKV+xJZTUgoeyRnMoYf/aBuqrArnN1WBHDhEIgGhxxymSJdBtR6oBzRiPiL
SPSJ/thNvBBBoVWw+MW3t6WJC0vR4ImZaoscZLQzShgL9ngHs8fqfS7OcRuhC6e0
hpXb9uGiErqybvnVNpY6OisShBoN1n+x6812TMIhqAfR6RzlA6n5ZiZKpnvrmC2/
FUURURlaSWMX+fO/DbHUwI8SZi9oN11y/9PoLOB5nNt42t23xB9+f4i6D0Dmm4s8
df78R/PPbjoOw/3dJrx4ETUIrQFSZDvV+aNTTG0B8sl8s57tAcYQU9fyzpocjkQr
/qs8Z2tnDlmWSOohkDHYM5ZgMiIiNgxorVW47/dhgIWnBK6zzZvhVnrxbvzb7EFT
VnHr3PldtiiwkN5n8ax6aHRliMe7vawTfKwyRS1bUkipee1wJVw+0VGfIR6jnE4O
EPzSr80oYgSrLDEHVNZbIP51vl5buh4iclNzA3a1KbVk+EcmQaEtnWtyAuHubM0j
z4fYz1RMOq035GegZdTXSS+jBZ7+/hXS3gaz9YxNt6CY5wmcYu5UlNoXoSRrTFmz
6CubW/gkq1k=
=n2Do
-----END PGP SIGNATURE-----