Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.1199
SUSE Security Update: Security update for qemu
12 May 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: qemu
Publisher: SUSE
Operating System: SUSE
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Increased Privileges -- Existing Account
Denial of Service -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2017-5898 CVE-2017-5856 CVE-2017-5667
CVE-2017-5526 CVE-2017-5525 CVE-2017-2620
CVE-2017-2615 CVE-2016-10155 CVE-2016-9922
CVE-2016-9921 CVE-2016-9911 CVE-2016-9907
CVE-2016-9776
Reference: ESB-2017.1076
ESB-2017.1022
ESB-2017.0627
ESB-2017.0606
ESB-2017.0555
ESB-2017.0546
- --------------------------BEGIN INCLUDED TEXT--------------------
SUSE Security Update: Security update for qemu
______________________________________________________________________________
Announcement ID: SUSE-SU-2017:1241-1
Rating: important
References: #1013285 #1014109 #1014111 #1014702 #1015048
#1015169 #1016779 #1020491 #1020589 #1020928
#1021129 #1022541 #1023004 #1023053 #1023907
#1024972 #937125
Cross-References: CVE-2016-10155 CVE-2016-9776 CVE-2016-9907
CVE-2016-9911 CVE-2016-9921 CVE-2016-9922
CVE-2017-2615 CVE-2017-2620 CVE-2017-5525
CVE-2017-5526 CVE-2017-5667 CVE-2017-5856
CVE-2017-5898
Affected Products:
SUSE Linux Enterprise Server 12-SP1
SUSE Linux Enterprise Desktop 12-SP1
______________________________________________________________________________
An update that solves 13 vulnerabilities and has four fixes
is now available.
Description:
This update for qemu fixes several issues.
These security issues were fixed:
- CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine
cirrus_bitblt_cputovideo failed to check the memory region, allowing for
an out-of-bounds write that allows for privilege escalation (bsc#1024972)
- CVE-2017-2615: An error in the bitblt copy operation could have allowed
a malicious guest administrator to cause an out of bounds memory access,
possibly leading to information disclosure or privilege escalation
(bsc#1023004)
- CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation
support was vulnerable to a memory leakage issue allowing a privileged
user to leak host memory resulting in DoS (bsc#1023053)
- CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support
was vulnerable to an infinite loop issue while receiving packets in
'mcf_fec_receive'. A privileged user/process inside guest could have
used this issue to crash the Qemu process on the host leading to DoS
(bsc#1013285)
- CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory
leakage issue while processing packet data in 'ehci_init_transfer'. A
guest user/process could have used this issue to leak host memory,
resulting in DoS for the host (bsc#1014111)
- CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a
memory leakage flaw when destroying the USB redirector in
'usbredir_handle_destroy'. A guest user/process could have used this
issue to leak host memory, resulting in DoS for a host (bsc#1014109)
- CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable
to a divide by zero issue while copying VGA data. A privileged user
inside guest could have used this flaw to crash the process instance on
the host, resulting in DoS (bsc#1014702)
- CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable
to a divide by zero issue while copying VGA data. A privileged user
inside guest could have used this flaw to crash the process instance on
the host, resulting in DoS (bsc#1014702)
- CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was
vulnerable to a memory leakage issue allowing a privileged user to cause
a DoS and/or potentially crash the Qemu process on the host (bsc#1021129)
- CVE-2017-5526: The ES1370 audio device emulation support was vulnerable
to a memory leakage issue allowing a privileged user inside the guest to
cause a DoS and/or potentially crash the Qemu process on the host
(bsc#1020589)
- CVE-2017-5525: The ac97 audio device emulation support was vulnerable to
a memory leakage issue allowing a privileged user inside the guest to
cause a DoS and/or potentially crash the Qemu process on the host
(bsc#1020491)
- CVE-2017-5667: The SDHCI device emulation support was vulnerable to an
OOB heap access issue allowing a privileged user inside the guest to
crash the Qemu process resulting in DoS or potentially execute arbitrary
code with privileges of the Qemu process on the host (bsc#1022541)
- CVE-2017-5898: The CCID Card device emulator support was vulnerable to
an integer overflow allowing a privileged user inside the guest to crash
the Qemu process resulting in DoS (bnc#1023907)
These non-security issues were fixed:
- Fix post script for qemu-guest-agent rpm to actually activate the guest
agent at rpm install time
- Fixed various inaccuracies in cirrus vga device emulation
- Fixed cause of infrequent migration failures from bad virtio device
state (bsc#1020928)
- Fixed virtio interface failure (bsc#1015048)
- Fixed graphical update errors introduced by previous security fix
(bsc#1016779)
- Fixed uint64 property parsing and add regression tests (bsc#937125)
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 12-SP1:
zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-740=1
- SUSE Linux Enterprise Desktop 12-SP1:
zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-740=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64):
qemu-2.3.1-32.11
qemu-block-curl-2.3.1-32.11
qemu-block-curl-debuginfo-2.3.1-32.11
qemu-debugsource-2.3.1-32.11
qemu-guest-agent-2.3.1-32.11
qemu-guest-agent-debuginfo-2.3.1-32.11
qemu-lang-2.3.1-32.11
qemu-tools-2.3.1-32.11
qemu-tools-debuginfo-2.3.1-32.11
- SUSE Linux Enterprise Server 12-SP1 (s390x x86_64):
qemu-kvm-2.3.1-32.11
- SUSE Linux Enterprise Server 12-SP1 (ppc64le):
qemu-ppc-2.3.1-32.11
qemu-ppc-debuginfo-2.3.1-32.11
- SUSE Linux Enterprise Server 12-SP1 (noarch):
qemu-ipxe-1.0.0-32.11
qemu-seabios-1.8.1-32.11
qemu-sgabios-8-32.11
qemu-vgabios-1.8.1-32.11
- SUSE Linux Enterprise Server 12-SP1 (x86_64):
qemu-block-rbd-2.3.1-32.11
qemu-block-rbd-debuginfo-2.3.1-32.11
qemu-x86-2.3.1-32.11
- SUSE Linux Enterprise Server 12-SP1 (s390x):
qemu-s390-2.3.1-32.11
qemu-s390-debuginfo-2.3.1-32.11
- SUSE Linux Enterprise Desktop 12-SP1 (noarch):
qemu-ipxe-1.0.0-32.11
qemu-seabios-1.8.1-32.11
qemu-sgabios-8-32.11
qemu-vgabios-1.8.1-32.11
- SUSE Linux Enterprise Desktop 12-SP1 (x86_64):
qemu-2.3.1-32.11
qemu-block-curl-2.3.1-32.11
qemu-block-curl-debuginfo-2.3.1-32.11
qemu-debugsource-2.3.1-32.11
qemu-kvm-2.3.1-32.11
qemu-tools-2.3.1-32.11
qemu-tools-debuginfo-2.3.1-32.11
qemu-x86-2.3.1-32.11
References:
https://www.suse.com/security/cve/CVE-2016-10155.html
https://www.suse.com/security/cve/CVE-2016-9776.html
https://www.suse.com/security/cve/CVE-2016-9907.html
https://www.suse.com/security/cve/CVE-2016-9911.html
https://www.suse.com/security/cve/CVE-2016-9921.html
https://www.suse.com/security/cve/CVE-2016-9922.html
https://www.suse.com/security/cve/CVE-2017-2615.html
https://www.suse.com/security/cve/CVE-2017-2620.html
https://www.suse.com/security/cve/CVE-2017-5525.html
https://www.suse.com/security/cve/CVE-2017-5526.html
https://www.suse.com/security/cve/CVE-2017-5667.html
https://www.suse.com/security/cve/CVE-2017-5856.html
https://www.suse.com/security/cve/CVE-2017-5898.html
https://bugzilla.suse.com/1013285
https://bugzilla.suse.com/1014109
https://bugzilla.suse.com/1014111
https://bugzilla.suse.com/1014702
https://bugzilla.suse.com/1015048
https://bugzilla.suse.com/1015169
https://bugzilla.suse.com/1016779
https://bugzilla.suse.com/1020491
https://bugzilla.suse.com/1020589
https://bugzilla.suse.com/1020928
https://bugzilla.suse.com/1021129
https://bugzilla.suse.com/1022541
https://bugzilla.suse.com/1023004
https://bugzilla.suse.com/1023053
https://bugzilla.suse.com/1023907
https://bugzilla.suse.com/1024972
https://bugzilla.suse.com/937125
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWRUUCIx+lLeg9Ub1AQhGUA//X6hVKnyk4T8r6Ng7v0p2oq48ezG1HhDO
YyMWum69X4ICRSgifdBUBcagSp4mcBQQJoBjzWqMHKOO8ixXgR9+SdprmmMesXkk
rddCUpb4FskaZCUBzGuw4Y6QVQnHrHbvPIcFV/e3cqD0A74KGwuDcWQnAhPQ3qy+
h/XBKYXrJ5zVDCPVyRRU9L10BCELmL72opgw8Mz4ETOddywwhZ9qHE9X3iprfrPx
vFXT/vAHd3BC6/UWgdk3ElnonK+AiV/oWma0hqcJOBX5/gcqULmMqm9E6o9DX1Ob
1SMMORUZ9SUtI6wEtAOuNOU84w201K3zx7GqkvfIXbOEPS3gKTzl/nlZ0U4zpaSl
mSyRKuRzIPBmeLm+N0dm8pxBxU8OIJVh8mSl9cEgBQ2/Sc4nOhJCMEPKoAUmytW5
q3ThShEMBJeDyXmm/n/kd6wW9561m+sG/MU9DzLXk7uQokKTxyB7WJUlgj8Z3c1X
YPpfR+i5whVGIS0LeIMQfmoZy4nPSekad4UJirTyy++8+JUm96wVsHOMD2ODiPzZ
Oh+Fv7ZkfPN+BKpenZlPwhOLSiGhZSot/JD7/10yDhE84+d/OvaNkGbAR9LkJlW+
owkua/eWhb16S3HSvlQ102ly0X8PJCbwFjEStDBxkXq5fRd+GNmRs0WsicG7SW8l
Vnub36NvqYU=
=Rpt4
-----END PGP SIGNATURE-----