SUSE Security Update: Security update for qemu
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:2924-1
Rating:             important
References:         #1054724 #1055587 #1056291 #1056334 #1057378 
                    #1057585 #1057966 #1062069 #1062942 #1063122 
                    
Cross-References:   CVE-2017-10911 CVE-2017-12809 CVE-2017-13672
                    CVE-2017-13711 CVE-2017-14167 CVE-2017-15038
                    CVE-2017-15268 CVE-2017-15289
Affected Products:
                    SUSE Linux Enterprise Server 12-SP3
                    SUSE Linux Enterprise Desktop 12-SP3
______________________________________________________________________________

   An update that solves 8 vulnerabilities and has two fixes
   is now available.

Description:

   This update for qemu to version 2.9.1 fixes several issues.

   It also announces that the qed storage format will be no longer supported
   in SLE 15 (fate#324200).

   These security issues were fixed:

   - CVE-2017-15268: Qemu allowed remote attackers to cause a memory leak by
     triggering slow data-channel read operations, related to
     io/channel-websock.c (bsc#1062942)
   - CVE-2017-15289: The mode4and5 write functions allowed local OS guest
     privileged users to cause a denial of service (out-of-bounds write
     access and Qemu process crash) via vectors related to dst calculation
     (bsc#1063122)
   - CVE-2017-15038: Race condition in the v9fs_xattrwalk function local
     guest OS users to obtain sensitive information from host heap memory via
     vectors related to reading extended attributes (bsc#1062069)
   - CVE-2017-10911: The make_response function in the Linux kernel allowed
     guest OS users to obtain sensitive information from host OS (or other
     guest OS) kernel memory by leveraging the copying of uninitialized
     padding fields in Xen block-interface response structures (bsc#1057378)
   - CVE-2017-12809: The IDE disk and CD/DVD-ROM Emulator support allowed
     local guest OS privileged users to cause a denial of service (NULL
     pointer dereference and QEMU process crash) by flushing an empty CDROM
     device drive (bsc#1054724)
   - CVE-2017-14167: Integer overflow in the load_multiboot function allowed
     local guest OS users to execute arbitrary code on the host via crafted
     multiboot header address values, which trigger an out-of-bounds write
     (bsc#1057585)
   - CVE-2017-13672: The VGA display emulator support allowed local guest OS
     privileged users to cause a denial of service (out-of-bounds read and
     QEMU process crash) via vectors involving display update (bsc#1056334)
   - CVE-2017-13711: Use-after-free vulnerability allowed attackers to cause
     a denial of service (QEMU instance crash) by leveraging failure to
     properly clear ifq_so from pending packets (bsc#1056291).

   These non-security issues were fixed:

   - Fixed not being able to build from rpm sources due to undefined macro
     (bsc#1057966)
   - Fiedx package build failure against new glibc (bsc#1055587)


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 12-SP3:

      zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1810=1

   - SUSE Linux Enterprise Desktop 12-SP3:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-1810=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64):

      qemu-2.9.1-6.6.3
      qemu-block-curl-2.9.1-6.6.3
      qemu-block-curl-debuginfo-2.9.1-6.6.3
      qemu-block-iscsi-2.9.1-6.6.3
      qemu-block-iscsi-debuginfo-2.9.1-6.6.3
      qemu-block-ssh-2.9.1-6.6.3
      qemu-block-ssh-debuginfo-2.9.1-6.6.3
      qemu-debugsource-2.9.1-6.6.3
      qemu-guest-agent-2.9.1-6.6.3
      qemu-guest-agent-debuginfo-2.9.1-6.6.3
      qemu-lang-2.9.1-6.6.3
      qemu-tools-2.9.1-6.6.3
      qemu-tools-debuginfo-2.9.1-6.6.3

   - SUSE Linux Enterprise Server 12-SP3 (aarch64 x86_64):

      qemu-block-rbd-2.9.1-6.6.3
      qemu-block-rbd-debuginfo-2.9.1-6.6.3

   - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64):

      qemu-kvm-2.9.1-6.6.3

   - SUSE Linux Enterprise Server 12-SP3 (ppc64le):

      qemu-ppc-2.9.1-6.6.3
      qemu-ppc-debuginfo-2.9.1-6.6.3

   - SUSE Linux Enterprise Server 12-SP3 (aarch64):

      qemu-arm-2.9.1-6.6.3
      qemu-arm-debuginfo-2.9.1-6.6.3

   - SUSE Linux Enterprise Server 12-SP3 (noarch):

      qemu-ipxe-1.0.0-6.6.3
      qemu-seabios-1.10.2-6.6.3
      qemu-sgabios-8-6.6.3
      qemu-vgabios-1.10.2-6.6.3

   - SUSE Linux Enterprise Server 12-SP3 (x86_64):

      qemu-x86-2.9.1-6.6.3

   - SUSE Linux Enterprise Server 12-SP3 (s390x):

      qemu-s390-2.9.1-6.6.3
      qemu-s390-debuginfo-2.9.1-6.6.3

   - SUSE Linux Enterprise Desktop 12-SP3 (noarch):

      qemu-ipxe-1.0.0-6.6.3
      qemu-seabios-1.10.2-6.6.3
      qemu-sgabios-8-6.6.3
      qemu-vgabios-1.10.2-6.6.3

   - SUSE Linux Enterprise Desktop 12-SP3 (x86_64):

      qemu-2.9.1-6.6.3
      qemu-block-curl-2.9.1-6.6.3
      qemu-block-curl-debuginfo-2.9.1-6.6.3
      qemu-debugsource-2.9.1-6.6.3
      qemu-kvm-2.9.1-6.6.3
      qemu-tools-2.9.1-6.6.3
      qemu-tools-debuginfo-2.9.1-6.6.3
      qemu-x86-2.9.1-6.6.3


References:

   https://www.suse.com/security/cve/CVE-2017-10911.html
   https://www.suse.com/security/cve/CVE-2017-12809.html
   https://www.suse.com/security/cve/CVE-2017-13672.html
   https://www.suse.com/security/cve/CVE-2017-13711.html
   https://www.suse.com/security/cve/CVE-2017-14167.html
   https://www.suse.com/security/cve/CVE-2017-15038.html
   https://www.suse.com/security/cve/CVE-2017-15268.html
   https://www.suse.com/security/cve/CVE-2017-15289.html
   https://bugzilla.suse.com/1054724
   https://bugzilla.suse.com/1055587
   https://bugzilla.suse.com/1056291
   https://bugzilla.suse.com/1056334
   https://bugzilla.suse.com/1057378
   https://bugzilla.suse.com/1057585
   https://bugzilla.suse.com/1057966
   https://bugzilla.suse.com/1062069
   https://bugzilla.suse.com/1062942
   https://bugzilla.suse.com/1063122

SuSE: 2017:2924-1: important: qemu

November 3, 2017
An update that solves 8 vulnerabilities and has two fixes An update that solves 8 vulnerabilities and has two fixes An update that solves 8 vulnerabilities and has two fixes is now...

Summary

This update for qemu to version 2.9.1 fixes several issues. It also announces that the qed storage format will be no longer supported in SLE 15 (fate#324200). These security issues were fixed: - CVE-2017-15268: Qemu allowed remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c (bsc#1062942) - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063122) - CVE-2017-15038: Race condition in the v9fs_xattrwalk function local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes (bsc#1062069) - CVE-2017-10911: The make_response function in the Linux kernel allowed guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures (bsc#1057378) - CVE-2017-12809: The IDE disk and CD/DVD-ROM Emulator support allowed local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by flushing an empty CDROM device drive (bsc#1054724) - CVE-2017-14167: Integer overflow in the load_multiboot function allowed local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write (bsc#1057585) - CVE-2017-13672: The VGA display emulator support allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update (bsc#1056334) - CVE-2017-13711: Use-after-free vulnerability allowed attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from pending packets (bsc#1056291). These non-security issues were fixed: - Fixed not being able to build from rpm sources due to undefined macro (bsc#1057966) - Fiedx package build failure against new glibc (bsc#1055587) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP3: zypper in -t patch SUSE-SLE-SERVER-12-SP3-2017-1810=1 - SUSE Linux Enterprise Desktop 12-SP3: zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2017-1810=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12-SP3 (aarch64 ppc64le s390x x86_64): qemu-2.9.1-6.6.3 qemu-block-curl-2.9.1-6.6.3 qemu-block-curl-debuginfo-2.9.1-6.6.3 qemu-block-iscsi-2.9.1-6.6.3 qemu-block-iscsi-debuginfo-2.9.1-6.6.3 qemu-block-ssh-2.9.1-6.6.3 qemu-block-ssh-debuginfo-2.9.1-6.6.3 qemu-debugsource-2.9.1-6.6.3 qemu-guest-agent-2.9.1-6.6.3 qemu-guest-agent-debuginfo-2.9.1-6.6.3 qemu-lang-2.9.1-6.6.3 qemu-tools-2.9.1-6.6.3 qemu-tools-debuginfo-2.9.1-6.6.3 - SUSE Linux Enterprise Server 12-SP3 (aarch64 x86_64): qemu-block-rbd-2.9.1-6.6.3 qemu-block-rbd-debuginfo-2.9.1-6.6.3 - SUSE Linux Enterprise Server 12-SP3 (s390x x86_64): qemu-kvm-2.9.1-6.6.3 - SUSE Linux Enterprise Server 12-SP3 (ppc64le): qemu-ppc-2.9.1-6.6.3 qemu-ppc-debuginfo-2.9.1-6.6.3 - SUSE Linux Enterprise Server 12-SP3 (aarch64): qemu-arm-2.9.1-6.6.3 qemu-arm-debuginfo-2.9.1-6.6.3 - SUSE Linux Enterprise Server 12-SP3 (noarch): qemu-ipxe-1.0.0-6.6.3 qemu-seabios-1.10.2-6.6.3 qemu-sgabios-8-6.6.3 qemu-vgabios-1.10.2-6.6.3 - SUSE Linux Enterprise Server 12-SP3 (x86_64): qemu-x86-2.9.1-6.6.3 - SUSE Linux Enterprise Server 12-SP3 (s390x): qemu-s390-2.9.1-6.6.3 qemu-s390-debuginfo-2.9.1-6.6.3 - SUSE Linux Enterprise Desktop 12-SP3 (noarch): qemu-ipxe-1.0.0-6.6.3 qemu-seabios-1.10.2-6.6.3 qemu-sgabios-8-6.6.3 qemu-vgabios-1.10.2-6.6.3 - SUSE Linux Enterprise Desktop 12-SP3 (x86_64): qemu-2.9.1-6.6.3 qemu-block-curl-2.9.1-6.6.3 qemu-block-curl-debuginfo-2.9.1-6.6.3 qemu-debugsource-2.9.1-6.6.3 qemu-kvm-2.9.1-6.6.3 qemu-tools-2.9.1-6.6.3 qemu-tools-debuginfo-2.9.1-6.6.3 qemu-x86-2.9.1-6.6.3

References

#1054724 #1055587 #1056291 #1056334 #1057378

#1057585 #1057966 #1062069 #1062942 #1063122

Cross- CVE-2017-10911 CVE-2017-12809 CVE-2017-13672

CVE-2017-13711 CVE-2017-14167 CVE-2017-15038

CVE-2017-15268 CVE-2017-15289

Affected Products:

SUSE Linux Enterprise Server 12-SP3

SUSE Linux Enterprise Desktop 12-SP3

https://www.suse.com/security/cve/CVE-2017-10911.html

https://www.suse.com/security/cve/CVE-2017-12809.html

https://www.suse.com/security/cve/CVE-2017-13672.html

https://www.suse.com/security/cve/CVE-2017-13711.html

https://www.suse.com/security/cve/CVE-2017-14167.html

https://www.suse.com/security/cve/CVE-2017-15038.html

https://www.suse.com/security/cve/CVE-2017-15268.html

https://www.suse.com/security/cve/CVE-2017-15289.html

https://bugzilla.suse.com/1054724

https://bugzilla.suse.com/1055587

https://bugzilla.suse.com/1056291

https://bugzilla.suse.com/1056334

https://bugzilla.suse.com/1057378

https://bugzilla.suse.com/1057585

https://bugzilla.suse.com/1057966

https://bugzilla.suse.com/1062069

https://bugzilla.suse.com/1062942

https://bugzilla.suse.com/1063122

Severity
Announcement ID: SUSE-SU-2017:2924-1
Rating: important

Related News

Fighting Back Against Hadooken Malware by Strengthening WebLogic Security
2 - 4 min read
Cybercriminals have been relentlessly attacking the digital landscape, aiming to exploit vulnerabilities in well-known systems. One such exploit is
CISA Sounds Alarm on Newly Exploited Vulnerabilities: Is Your System at Risk?
3 - 5 min read
CISA regularly publishes updates regarding vulnerabilities that present severe threats to global cybersecurity. Recently, CISA added three
Defending Against Remote Code Execution in Google Chrome: A Critical Update
2 - 3 min read
Google Chrome, a widely used web browser, serves millions of internet users by connecting them to the online world. Unfortunately, severe
Navigating the Linux Kernel
2 - 4 min read
The Linux operating system, widely acclaimed for its robustness and security , recently received widespread media attention due to a significant
Staying a Step Ahead of Adversaries: Mitigating Chromium
2 - 4 min read
Google Chrome, one of the world's most widely used web browsers, has recently been scrutinized due to the discovery of multiple Chromium
Unmasking Cicada3301: Examining the Threat of the New Rust-Based Ransomware
2 - 4 min read
Ransomware has long been a severe threat to organizations and admins alike. Recently, cybersecurity researchers discovered a new variant called
Buffer Overflow Exploits in Linux: Origins, Impact, and Countermeasures
3 - 6 min read
Buffer overflow vulnerabilities have long been one of the biggest headaches in computer security, especially on Linux operating systems that power
8 Expert-Recommended Security Practices to Fortify Your Linux Systems
4 - 8 min read
As a Linux admin or an infosec professional, you understand how the security landscape changes due to evolving threats, newly discovered

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved