Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.0606
SUSE Security Update: Security update for qemu
8 March 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: qemu
Publisher: SUSE
Operating System: SUSE
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Increased Privileges -- Existing Account
Denial of Service -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2017-5898 CVE-2017-5857 CVE-2017-5856
CVE-2017-5667 CVE-2017-5578 CVE-2017-5552
CVE-2017-5526 CVE-2017-5525 CVE-2017-2620
CVE-2017-2615 CVE-2016-10155 CVE-2016-10029
CVE-2016-10028 CVE-2016-9922 CVE-2016-9921
Reference: ESB-2017.0576
ESB-2017.0555
ESB-2017.0546
ESB-2017.0538
ESB-2017.0123
Original Bulletin:
https://lists.opensuse.org/opensuse-security-announce/2017-03/msg00005.html
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for qemu
______________________________________________________________________________
Announcement ID: SUSE-SU-2017:0625-1
Rating: important
References: #1014702 #1015169 #1016779 #1017081 #1017084
#1020491 #1020589 #1020928 #1021129 #1021195
#1021481 #1022541 #1023004 #1023053 #1023073
#1023907 #1024972 #1026583 #977027
Cross-References: CVE-2016-10028 CVE-2016-10029 CVE-2016-10155
CVE-2016-9921 CVE-2016-9922 CVE-2017-2615
CVE-2017-2620 CVE-2017-5525 CVE-2017-5526
CVE-2017-5552 CVE-2017-5578 CVE-2017-5667
CVE-2017-5856 CVE-2017-5857 CVE-2017-5898
Affected Products:
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2
SUSE Linux Enterprise Server 12-SP2
SUSE Linux Enterprise Desktop 12-SP2
______________________________________________________________________________
An update that solves 15 vulnerabilities and has four fixes
is now available.
Description:
This update for qemu fixes several issues.
These security issues were fixed:
- CVE-2017-5898: The CCID Card device emulator support was vulnerable to
an integer overflow flaw allowing a privileged user to crash the Qemu
process on the host resulting in DoS (bsc#1023907).
- CVE-2017-5857: The Virtio GPU Device emulator support was vulnerable to
a host memory leakage issue allowing a guest user to leak host memory
resulting in DoS (bsc#1023073).
- CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine
cirrus_bitblt_cputovideo failed to check the memory region, allowing for
an out-of-bounds write that allows for privilege escalation (bsc#1024972)
- CVE-2017-2615: An error in the bitblt copy operation could have allowed
a malicious guest administrator to cause an out of bounds memory access,
possibly leading to information disclosure or privilege escalation
(bsc#1023004)
- CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation
support was vulnerable to a memory leakage issue allowing a privileged
user to leak host memory resulting in DoS (bsc#1023053)
- CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable
to a divide by zero issue while copying VGA data. A privileged user
inside guest could have used this flaw to crash the process instance on
the host, resulting in DoS (bsc#1014702)
- CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable
to a divide by zero issue while copying VGA data. A privileged user
inside guest could have used this flaw to crash the process instance on
the host, resulting in DoS (bsc#1014702)
- CVE-2016-10029: The Virtio GPU Device emulator support was vulnerable to
an OOB read issue allowing a guest user to crash the Qemu process
instance resulting in Dos (bsc#1017081).
- CVE-2016-10028: The Virtio GPU Device emulator support was vulnerable to
an out of bounds memory access issue allowing a guest user to crash the
Qemu process instance on a host, resulting in DoS (bsc#1017084).
- CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was
vulnerable to a memory leakage issue allowing a privileged user to cause
a DoS and/or potentially crash the Qemu process on the host (bsc#1021129)
- CVE-2017-5552: The Virtio GPU Device emulator support was vulnerable to
a memory leakage issue allowing a guest user to leak host memory
resulting in DoS (bsc#1021195).
- CVE-2017-5578: The Virtio GPU Device emulator support was vulnerable to
a memory leakage issue allowing a guest user to leak host memory
resulting in DoS (bsc#1021481).
- CVE-2017-5526: The ES1370 audio device emulation support was vulnerable
to a memory leakage issue allowing a privileged user inside the guest to
cause a DoS and/or potentially crash the Qemu process on the host
(bsc#1020589).
- CVE-2017-5525: The ac97 audio device emulation support was vulnerable to
a memory leakage issue allowing a privileged user inside the guest to
cause a DoS and/or potentially crash the Qemu process on the host
(bsc#1020491).
- CVE-2017-5667: The SDHCI device emulation support was vulnerable to an
OOB heap access issue allowing a privileged user inside the guest to
crash the Qemu process resulting in DoS or potentially execute arbitrary
code with privileges of the Qemu process on the host (bsc#1022541).
- CVE-2017-5898: The CCID Card device emulator support was vulnerable to
an integer overflow allowing a privileged user inside the guest to crash
the Qemu process resulting in DoS (bnc#1023907)
These non-security issues were fixed:
- Fix name of s390x specific sysctl configuration file to end with .conf
(bsc#1026583)
- XHCI fixes (bsc#977027)
- Fixed rare race during s390x guest reboot
- Fixed various inaccuracies in cirrus vga device emulation
- Fixed cause of infrequent migration failures from bad virtio device
state (bsc#1020928)
- Fixed graphical update errors introduced by previous security fix
(bsc#1016779)
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server for Raspberry Pi 12-SP2:
zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-336=1
- SUSE Linux Enterprise Server 12-SP2:
zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-336=1
- SUSE Linux Enterprise Desktop 12-SP2:
zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-336=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64):
qemu-2.6.2-41.9.1
qemu-arm-2.6.2-41.9.1
qemu-arm-debuginfo-2.6.2-41.9.1
qemu-block-curl-2.6.2-41.9.1
qemu-block-curl-debuginfo-2.6.2-41.9.1
qemu-block-rbd-2.6.2-41.9.1
qemu-block-rbd-debuginfo-2.6.2-41.9.1
qemu-block-ssh-2.6.2-41.9.1
qemu-block-ssh-debuginfo-2.6.2-41.9.1
qemu-debugsource-2.6.2-41.9.1
qemu-guest-agent-2.6.2-41.9.1
qemu-guest-agent-debuginfo-2.6.2-41.9.1
qemu-lang-2.6.2-41.9.1
qemu-tools-2.6.2-41.9.1
qemu-tools-debuginfo-2.6.2-41.9.1
- SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch):
qemu-ipxe-1.0.0-41.9.1
- SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64):
qemu-2.6.2-41.9.1
qemu-block-curl-2.6.2-41.9.1
qemu-block-curl-debuginfo-2.6.2-41.9.1
qemu-block-ssh-2.6.2-41.9.1
qemu-block-ssh-debuginfo-2.6.2-41.9.1
qemu-debugsource-2.6.2-41.9.1
qemu-guest-agent-2.6.2-41.9.1
qemu-guest-agent-debuginfo-2.6.2-41.9.1
qemu-lang-2.6.2-41.9.1
qemu-tools-2.6.2-41.9.1
qemu-tools-debuginfo-2.6.2-41.9.1
- SUSE Linux Enterprise Server 12-SP2 (aarch64 x86_64):
qemu-block-rbd-2.6.2-41.9.1
qemu-block-rbd-debuginfo-2.6.2-41.9.1
- SUSE Linux Enterprise Server 12-SP2 (ppc64le):
qemu-ppc-2.6.2-41.9.1
qemu-ppc-debuginfo-2.6.2-41.9.1
- SUSE Linux Enterprise Server 12-SP2 (aarch64):
qemu-arm-2.6.2-41.9.1
qemu-arm-debuginfo-2.6.2-41.9.1
- SUSE Linux Enterprise Server 12-SP2 (x86_64):
qemu-kvm-2.6.2-41.9.1
qemu-x86-2.6.2-41.9.1
- SUSE Linux Enterprise Server 12-SP2 (noarch):
qemu-ipxe-1.0.0-41.9.1
qemu-seabios-1.9.1-41.9.1
qemu-sgabios-8-41.9.1
qemu-vgabios-1.9.1-41.9.1
- SUSE Linux Enterprise Desktop 12-SP2 (x86_64):
qemu-2.6.2-41.9.1
qemu-block-curl-2.6.2-41.9.1
qemu-block-curl-debuginfo-2.6.2-41.9.1
qemu-debugsource-2.6.2-41.9.1
qemu-kvm-2.6.2-41.9.1
qemu-tools-2.6.2-41.9.1
qemu-tools-debuginfo-2.6.2-41.9.1
qemu-x86-2.6.2-41.9.1
- SUSE Linux Enterprise Desktop 12-SP2 (noarch):
qemu-ipxe-1.0.0-41.9.1
qemu-seabios-1.9.1-41.9.1
qemu-sgabios-8-41.9.1
qemu-vgabios-1.9.1-41.9.1
References:
https://www.suse.com/security/cve/CVE-2016-10028.html
https://www.suse.com/security/cve/CVE-2016-10029.html
https://www.suse.com/security/cve/CVE-2016-10155.html
https://www.suse.com/security/cve/CVE-2016-9921.html
https://www.suse.com/security/cve/CVE-2016-9922.html
https://www.suse.com/security/cve/CVE-2017-2615.html
https://www.suse.com/security/cve/CVE-2017-2620.html
https://www.suse.com/security/cve/CVE-2017-5525.html
https://www.suse.com/security/cve/CVE-2017-5526.html
https://www.suse.com/security/cve/CVE-2017-5552.html
https://www.suse.com/security/cve/CVE-2017-5578.html
https://www.suse.com/security/cve/CVE-2017-5667.html
https://www.suse.com/security/cve/CVE-2017-5856.html
https://www.suse.com/security/cve/CVE-2017-5857.html
https://www.suse.com/security/cve/CVE-2017-5898.html
https://bugzilla.suse.com/1014702
https://bugzilla.suse.com/1015169
https://bugzilla.suse.com/1016779
https://bugzilla.suse.com/1017081
https://bugzilla.suse.com/1017084
https://bugzilla.suse.com/1020491
https://bugzilla.suse.com/1020589
https://bugzilla.suse.com/1020928
https://bugzilla.suse.com/1021129
https://bugzilla.suse.com/1021195
https://bugzilla.suse.com/1021481
https://bugzilla.suse.com/1022541
https://bugzilla.suse.com/1023004
https://bugzilla.suse.com/1023053
https://bugzilla.suse.com/1023073
https://bugzilla.suse.com/1023907
https://bugzilla.suse.com/1024972
https://bugzilla.suse.com/1026583
https://bugzilla.suse.com/977027
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWL+6FIx+lLeg9Ub1AQiC+A/+OkLIE7JAbyG53h8K+toQGqQSh8qFksRG
Dy08yZqeBd45NxKfEqpDGzy84xeXPM9zJmfi2bb6HvroQOI9+lE4jPJ7OA7pa4w2
FBNT6B5uLgI7CiAjo+Ejh+KgBuBqbDqhGeC6Qr4tFiPe5W6kT2jcyJSJqYE2B1Aj
GRbv3gtEpzqQ6+uVu2UI3obi/3r8r39AW9N+chKkIFYvdVcBmf5BGgW4wMTQycjz
lMvbJ2u48PjjhN8Ry11kIVsvTpk48RkNUtiSy7QYkuWdQHBb0Gkw5gYI2xra/a4H
U4rfw46/rd0GKu6CmwapKilnJrT5sOevQPdSKeN9TWqilQ7Ckqyg7Y2UHtkScneE
bmUjjyAIxpW8bdzlRiWlcVdDrUBA8lF5rDT9GpRkfJJ3ruew3bcZdhHKsaFnbREI
YMoDbWsnsOU/je/XwLD1bUtSZrxnX+HBhswqQ60xnTLqdHOctE0yn4dxKBR5r/pO
LmB0t0/eeiHVFGuM/jdFC7h9CnnlZj4/iP+HDPbJi37t0kU/LDtACpqrAvIjgUAO
N5JoViqWjxbOj+IM5W6+/kdHbAsbvEp7WQcLfBP3ICTAU7ymJPikKUjl0ZBEFK0O
Sh/PcrcNvukFi1lvLs+2XEtAUNqaJHr6aY+6z6rn04CRibh29fHHhCJtE0604cLE
atjBCZ0f4Ls=
=FrIF
-----END PGP SIGNATURE-----