Operating System:

[SUSE]

Published:

16 January 2017

Protect yourself against future threats.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.0123
              SUSE Security Update: Security update for qemu
                              16 January 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:          qemu
Publisher:        SUSE
Operating System: SUSE
Impact/Access:    Execute Arbitrary Code/Commands -- Existing Account
                  Increased Privileges            -- Existing Account
                  Denial of Service               -- Existing Account
                  Access Confidential Data        -- Existing Account
Resolution:       Patch/Upgrade
CVE Names:        CVE-2016-9922 CVE-2016-9921 CVE-2016-9913
                  CVE-2016-9912 CVE-2016-9911 CVE-2016-9908
                  CVE-2016-9907 CVE-2016-9846 CVE-2016-9845
                  CVE-2016-9776 CVE-2016-9381 CVE-2016-9103
                  CVE-2016-9102  

Reference:        ESB-2016.2850
                  ESB-2016.2826
                  ESB-2016.2707

- --------------------------BEGIN INCLUDED TEXT--------------------

   SUSE Security Update: Security update for qemu
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:0127-1
Rating:             important
References:         #1007454 #1008519 #1009109 #1013285 #1013341 
                    #1013764 #1013767 #1014109 #1014110 #1014111 
                    #1014112 #1014256 #1014514 #1016779 #937125 
                    
Cross-References:   CVE-2016-9102 CVE-2016-9103 CVE-2016-9381
                    CVE-2016-9776 CVE-2016-9845 CVE-2016-9846
                    CVE-2016-9907 CVE-2016-9908 CVE-2016-9911
                    CVE-2016-9912 CVE-2016-9913 CVE-2016-9921
                    CVE-2016-9922
Affected Products:
                    SUSE Linux Enterprise Server for Raspberry Pi 12-SP2
                    SUSE Linux Enterprise Server 12-SP2
                    SUSE Linux Enterprise Desktop 12-SP2
______________________________________________________________________________

   An update that solves 13 vulnerabilities and has two fixes
   is now available.

Description:


   qemu was updated to fix several issues.

   These security issues were fixed:

   - CVE-2016-9102: Memory leak in the v9fs_xattrcreate function in
     hw/9pfs/9p.c in allowed local guest OS administrators to cause a denial
     of service (memory consumption and QEMU process crash) via a large
     number of Txattrcreate messages with the same fid number (bsc#1014256).
   - CVE-2016-9103: The v9fs_xattrcreate function in hw/9pfs/9p.c in allowed
     local guest OS administrators to obtain sensitive host heap memory
     information by reading xattribute values writing to them (bsc#1007454).
   - CVE-2016-9381: Improper processing of shared rings allowing guest
     administrators take over the qemu process, elevating their privilege to
     that of the qemu process (bsc#1009109)
   - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support
     was vulnerable to an infinite loop issue while receiving packets in
     'mcf_fec_receive'. A privileged user/process inside guest could have
     used this issue to crash the Qemu process on the host leading to DoS
     (bsc#1013285).
   - CVE-2016-9845: The Virtio GPU Device emulator support as vulnerable to
     an information leakage issue while processing the
     'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could
     have used this flaw to leak contents of the host memory (bsc#1013767).
   - CVE-2016-9846: The Virtio GPU Device emulator support was vulnerable to
     a memory leakage issue while updating the cursor data in
     update_cursor_data_virgl. A guest user/process could have used this flaw
     to leak host memory bytes, resulting in DoS for the host (bsc#1013764).
   - CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a
     memory leakage flaw when destroying the USB redirector in
     'usbredir_handle_destroy'.  A guest user/process could have used this
     issue to leak host memory, resulting in DoS for a host (bsc#1014109).
   - CVE-2016-9908: The Virtio GPU Device emulator support was vulnerable to
     an information leakage issue while processing the
     'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could have
     used this flaw to leak contents of the host memory (bsc#1014514).
   - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory
     leakage issue while processing packet data in 'ehci_init_transfer'. A
     guest user/process could have used this issue to leak host memory,
     resulting in DoS for the host (bsc#1014111).
   - CVE-2016-9912: The Virtio GPU Device emulator support was vulnerable to
     a memory leakage issue while destroying gpu resource object in
     'virtio_gpu_resource_destroy'. A guest user/process could have used this
     flaw to leak host memory bytes, resulting in DoS for the host
     (bsc#1014112).
   - CVE-2016-9913: VirtFS was vulnerable to memory leakage issue via its
     '9p-handle' or '9p-proxy' backend drivers. A privileged user inside
     guest could have used this flaw to leak host memory, thus affecting
     other services on the host and/or potentially crash the Qemu process on
     the host (bsc#1014110).

   These non-security issues were fixed:

   - Fixed uint64 property parsing and add regression tests (bsc#937125)
   - Added a man page for kvm_stat
   - Fix crash in vte (bsc#1008519)
   - Various upstream commits targeted towards stable releases (bsc#1013341)


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2:

      zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-68=1

   - SUSE Linux Enterprise Server 12-SP2:

      zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-68=1

   - SUSE Linux Enterprise Desktop 12-SP2:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-68=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64):

      qemu-2.6.2-39.1
      qemu-arm-2.6.2-39.1
      qemu-arm-debuginfo-2.6.2-39.1
      qemu-block-curl-2.6.2-39.1
      qemu-block-curl-debuginfo-2.6.2-39.1
      qemu-block-rbd-2.6.2-39.1
      qemu-block-rbd-debuginfo-2.6.2-39.1
      qemu-block-ssh-2.6.2-39.1
      qemu-block-ssh-debuginfo-2.6.2-39.1
      qemu-debugsource-2.6.2-39.1
      qemu-guest-agent-2.6.2-39.1
      qemu-guest-agent-debuginfo-2.6.2-39.1
      qemu-lang-2.6.2-39.1
      qemu-tools-2.6.2-39.1
      qemu-tools-debuginfo-2.6.2-39.1

   - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch):

      qemu-ipxe-1.0.0-39.1

   - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64):

      qemu-2.6.2-39.1
      qemu-block-curl-2.6.2-39.1
      qemu-block-curl-debuginfo-2.6.2-39.1
      qemu-block-ssh-2.6.2-39.1
      qemu-block-ssh-debuginfo-2.6.2-39.1
      qemu-debugsource-2.6.2-39.1
      qemu-guest-agent-2.6.2-39.1
      qemu-guest-agent-debuginfo-2.6.2-39.1
      qemu-lang-2.6.2-39.1
      qemu-tools-2.6.2-39.1
      qemu-tools-debuginfo-2.6.2-39.1

   - SUSE Linux Enterprise Server 12-SP2 (aarch64 x86_64):

      qemu-block-rbd-2.6.2-39.1
      qemu-block-rbd-debuginfo-2.6.2-39.1

   - SUSE Linux Enterprise Server 12-SP2 (ppc64le):

      qemu-ppc-2.6.2-39.1
      qemu-ppc-debuginfo-2.6.2-39.1

   - SUSE Linux Enterprise Server 12-SP2 (aarch64):

      qemu-arm-2.6.2-39.1
      qemu-arm-debuginfo-2.6.2-39.1

   - SUSE Linux Enterprise Server 12-SP2 (x86_64):

      qemu-kvm-2.6.2-39.1
      qemu-x86-2.6.2-39.1

   - SUSE Linux Enterprise Server 12-SP2 (noarch):

      qemu-ipxe-1.0.0-39.1
      qemu-seabios-1.9.1-39.1
      qemu-sgabios-8-39.1
      qemu-vgabios-1.9.1-39.1

   - SUSE Linux Enterprise Desktop 12-SP2 (noarch):

      qemu-ipxe-1.0.0-39.1
      qemu-seabios-1.9.1-39.1
      qemu-sgabios-8-39.1
      qemu-vgabios-1.9.1-39.1

   - SUSE Linux Enterprise Desktop 12-SP2 (x86_64):

      qemu-2.6.2-39.1
      qemu-block-curl-2.6.2-39.1
      qemu-block-curl-debuginfo-2.6.2-39.1
      qemu-debugsource-2.6.2-39.1
      qemu-kvm-2.6.2-39.1
      qemu-tools-2.6.2-39.1
      qemu-tools-debuginfo-2.6.2-39.1
      qemu-x86-2.6.2-39.1


References:

   https://www.suse.com/security/cve/CVE-2016-9102.html
   https://www.suse.com/security/cve/CVE-2016-9103.html
   https://www.suse.com/security/cve/CVE-2016-9381.html
   https://www.suse.com/security/cve/CVE-2016-9776.html
   https://www.suse.com/security/cve/CVE-2016-9845.html
   https://www.suse.com/security/cve/CVE-2016-9846.html
   https://www.suse.com/security/cve/CVE-2016-9907.html
   https://www.suse.com/security/cve/CVE-2016-9908.html
   https://www.suse.com/security/cve/CVE-2016-9911.html
   https://www.suse.com/security/cve/CVE-2016-9912.html
   https://www.suse.com/security/cve/CVE-2016-9913.html
   https://www.suse.com/security/cve/CVE-2016-9921.html
   https://www.suse.com/security/cve/CVE-2016-9922.html
   https://bugzilla.suse.com/1007454
   https://bugzilla.suse.com/1008519
   https://bugzilla.suse.com/1009109
   https://bugzilla.suse.com/1013285
   https://bugzilla.suse.com/1013341
   https://bugzilla.suse.com/1013764
   https://bugzilla.suse.com/1013767
   https://bugzilla.suse.com/1014109
   https://bugzilla.suse.com/1014110
   https://bugzilla.suse.com/1014111
   https://bugzilla.suse.com/1014112
   https://bugzilla.suse.com/1014256
   https://bugzilla.suse.com/1014514
   https://bugzilla.suse.com/1016779
   https://bugzilla.suse.com/937125

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWHxlvIx+lLeg9Ub1AQh8yg//bG2zrB5kbIhbfbBpASgA5ZZNBJ8BHeTT
Jtli9wZ9j/ICQWVypSmNngyG14gVxf41Kc4cSpUWgmUs5ElFXLMo5thqCHjikmPA
ZdVlPJV1JH9e4i1Y5nzZZtK0pzDruRo5jNCCP7umc5dwsNQYYqHpVj4qOS8ZfY/g
cloxGM20LD+hukCqCgixViuacd6CSnlWiYJqyfFMWSNIHpVS8Jyw+WbdkXPVFp59
7k4EaHnY24FWbw1r9QEJrjw4F4y5asdCZaVWehbJ6hd2/3v9THgAH5XTk5w4gLAY
PCJbP1eCTE7kh7idgfgR62Y961u9uUnE07oJ/V2UG9k5d+kH/vqb8ItZ2JROqizU
W7dBOZ5mv08k2eqh4Hmhd3KFU7Tf94fcda7qX0PJbu4qzvFVICCyVLJFWQmj3S/X
N8sXLtXfKIVfzrpjjzEFidQhPn1rR73asM9axTUkB8xcI+gsJ10KuXUy18BLWw4Z
b51kWCyj3WWAejplXbIFLzdqDm1d8+4c2JCgQcCh9tNKnUCD+zqNNB2Jqwhmf5B0
G10lsW7qqUrLc1o4uLbdezPPkQ/GJKeyqIKoBcQGq5MSG/aTKSNwsOajcIA7RNK3
69JTc5FAUrgFLE4n6ekr6LkZnJUBzM/tlLI5zJWNLD/EF72oK1w1c/aXGyJCV0ew
RqV7FzYVo4M=
=21WF
-----END PGP SIGNATURE-----