Bug 39545 – qemu-kvm: Multiple issues (3.2)

Bug 39545 - qemu-kvm: Multiple issues (3.2)


Summary:	qemu-kvm: Multiple issues (3.2)

Status:	CLOSED FIXED

Product:	UCS
Classification:	Unclassified
Component:	Security updates
Version:	UCS 3.2
Hardware:	Other Linux

Importance:	P3 normal (vote)
Target Milestone:	UCS 3.2-7-errata
Assigned To:	Philipp Hahn
QA Contact:	Daniel Tröder

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2015-10-14 19:23 CEST by Arvid Requate
Modified:	2015-11-19 13:30 CET (History)
CC List:	3 users (show)

See Also:
What kind of report is it?:	---
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):	Security
Max CVSS v3 score:

Flags:	requate: Patch_Available+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2015-10-14 19:23:40 CEST

Upstream Debian [wheezy] package version 1.1.2+dfsg-6a+deb7u11 fixes these issues:

* the QEMU model of the RTL8139 network card did not sufficiently validate inputs in the C+ mode offload emulation, allowing a malicious guest to read uninitialized memory from the QEMU process's heap (CVE-2015-5165)

* A buffer overflow vulnerability was discovered in the way QEMU handles the virtio-serial device. A malicious guest could use this flaw to mount a denial of service (QEMU process crash) (CVE-2015-5745)

* infinite loop when receiving packets in the NE2000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service (QEMU process crash) (CVE-2015-5278)

* heap buffer overflow flaw in the NE2000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service (QEMU process crash), or potentially to execute arbitrary code on the host with the privileges of the hosting QEMU process (CVE-2015-5279)

* infinite loop issue in the e1000 NIC emulation. A privileged guest user could use this flaw to mount a denial of service (QEMU process crash) (CVE-2015-6815)

* flaw in the IDE subsystem in QEMU occurring while executing IDE's WIN_READ_NATIVE_MAX command to determine the maximum size of a drive. A privileged guest user could use this flaw to mount a denial of service (QEMU process crash) (CVE-2015-6855)

+++ This bug was initially created as a clone of Bug #33279 +++

Comment 1 Philipp Hahn

2015-10-27 18:24:40 CET

$ repo_admin.py --cherrypick -r 4.0 -s errata4.0-3 --releasedest 3.2 --dest errata3.2-7 -p qemu-kvm

15391 | Bug #39545: qemu-kvm errata3.2-7
15392 | Bug #39545: qemu-kvm errata3.2-7

Package: qemu-kvm
Version: 1.1.2+dfsg-6.29.49.201510271754
Branch: ucs_3.2-0
Scope: errata3.2-7

r64908 | Bug #39545: qemu-kvm errata3.2-7
 2015-10-27-qemu-kvm.yaml

Comment 2 Daniel Tröder

2015-11-16 12:30:08 CET

OK: source version 1.1.2+dfsg-6+deb7u11 was imported
OK: YAML
OK: installs and can be executed, but without hardware I cannot test it more than that

Comment 3 Janek Walkenhorst

2015-11-19 13:30:23 CET

<http://errata.software-univention.de/ucs/3.2/380.html>