Bug 1004707 (CVE-2016-8669)

Summary: VUL-0: CVE-2016-8669: qemu, kvm: char: divide by zero error in serial_update_parameters
Product: [Novell Products] SUSE Security Incidents Reporter: Mikhail Kasimov <mikhail.kasimov>
Component: IncidentsAssignee: Bruce Rogers <brogers>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: brogers, jsegitz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard: CVSSv2:SUSE:CVE-2016-8669:4.4:(AV:L/AC:M/Au:S/C:N/I:N/A:C) CVSSv2:RedHat:CVE-2016-8669:2.3:(AV:A/AC:M/Au:S/C:N/I:N/A:P) CVSSv2:NVD:CVE-2016-8669:1.9:(AV:L/AC:M/Au:N/C:N/I:N/A:P) CVSSv3:RedHat:CVE-2016-8669:3.0:(AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L) CVSSv3:NVD:CVE-2016-8669:6.0:(AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Mikhail Kasimov 2016-10-14 11:34:30 UTC
Reference: http://seclists.org/oss-sec/2016/q4/131

=======================================
  Hello,

Quick Emulator(Qemu) built with the 16550A UART emulation support is vulnerable to a divide by zero issue. It could occur while updating serial device parameters in 'serial_update_parameters'.


A privileged guest user could use this flaw to crash the Qemu process instance on the host, resulting in DoS.


Upstream patch:
---------------
  -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02461.html

Reference:
----------
  -> https://bugzilla.redhat.com/show_bug.cgi?id=1384909

This issue was reported by Huawei Product Security Incident Response Team (PSIRT), Huawei Inc.



Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
=======================================
Comment 2 Swamp Workflow Management 2016-10-17 22:00:25 UTC
bugbot adjusting priority
Comment 3 Swamp Workflow Management 2016-11-22 18:07:49 UTC
SUSE-SU-2016:2879-1: An update that solves 21 vulnerabilities and has 6 fixes is now available.

Category: security (moderate)
Bug References: 1000345,1000346,1001151,1002116,1002549,1002550,1002557,1003612,1003613,1003878,1003893,1003894,1004702,1004706,1004707,1005353,1005374,1006536,1006538,1007263,1007391,1007493,1007494,1007495,1007769,1008148,998516
CVE References: CVE-2016-7161,CVE-2016-7170,CVE-2016-7422,CVE-2016-7466,CVE-2016-7907,CVE-2016-7908,CVE-2016-7909,CVE-2016-7994,CVE-2016-7995,CVE-2016-8576,CVE-2016-8577,CVE-2016-8578,CVE-2016-8667,CVE-2016-8668,CVE-2016-8669,CVE-2016-8909,CVE-2016-8910,CVE-2016-9101,CVE-2016-9104,CVE-2016-9105,CVE-2016-9106
Sources used:
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    qemu-2.6.2-31.2
SUSE Linux Enterprise Server 12-SP2 (src):    qemu-2.6.2-31.2
SUSE Linux Enterprise Desktop 12-SP2 (src):    qemu-2.6.2-31.2
Comment 4 Swamp Workflow Management 2016-11-24 17:11:59 UTC
SUSE-SU-2016:2902-1: An update that fixes 17 vulnerabilities is now available.

Category: security (important)
Bug References: 1001151,1002550,1002557,1003878,1003893,1003894,1004702,1004707,1006536,1006538,1007391,1007450,1007454,1007493,1007494,1007495,998516
CVE References: CVE-2016-7161,CVE-2016-7170,CVE-2016-7908,CVE-2016-7909,CVE-2016-8576,CVE-2016-8577,CVE-2016-8578,CVE-2016-8667,CVE-2016-8669,CVE-2016-8909,CVE-2016-8910,CVE-2016-9101,CVE-2016-9102,CVE-2016-9103,CVE-2016-9104,CVE-2016-9105,CVE-2016-9106
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    kvm-1.4.2-50.1
Comment 5 Swamp Workflow Management 2016-11-29 13:08:37 UTC
SUSE-SU-2016:2936-1: An update that solves 18 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1001151,1002116,1002550,1002557,1003878,1003893,1003894,1004702,1004707,1006536,1006538,1007391,1007450,1007454,1007493,1007494,1007495,998516,999661
CVE References: CVE-2016-7161,CVE-2016-7170,CVE-2016-7421,CVE-2016-7908,CVE-2016-7909,CVE-2016-8576,CVE-2016-8577,CVE-2016-8578,CVE-2016-8667,CVE-2016-8669,CVE-2016-8909,CVE-2016-8910,CVE-2016-9101,CVE-2016-9102,CVE-2016-9103,CVE-2016-9104,CVE-2016-9105,CVE-2016-9106
Sources used:
SUSE Linux Enterprise Server for SAP 12 (src):    qemu-2.0.2-48.25.1
SUSE Linux Enterprise Server 12-LTSS (src):    qemu-2.0.2-48.25.1
Comment 6 Swamp Workflow Management 2016-12-02 20:08:26 UTC
SUSE-SU-2016:2988-1: An update that solves 19 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1000345,1001151,1002116,1002550,1002557,1003878,1003893,1003894,1004702,1004707,1006536,1006538,1007391,1007450,1007454,1007493,1007494,1007495,996524,998516,999661
CVE References: CVE-2016-7161,CVE-2016-7170,CVE-2016-7421,CVE-2016-7466,CVE-2016-7908,CVE-2016-7909,CVE-2016-8576,CVE-2016-8577,CVE-2016-8578,CVE-2016-8667,CVE-2016-8669,CVE-2016-8909,CVE-2016-8910,CVE-2016-9101,CVE-2016-9102,CVE-2016-9103,CVE-2016-9104,CVE-2016-9105,CVE-2016-9106
Sources used:
SUSE Linux Enterprise Server 12-SP1 (src):    qemu-2.3.1-24.6
SUSE Linux Enterprise Desktop 12-SP1 (src):    qemu-2.3.1-24.6
Comment 7 Swamp Workflow Management 2016-12-12 18:20:18 UTC
openSUSE-SU-2016:3103-1: An update that solves 19 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1000345,1001151,1002116,1002550,1002557,1003878,1003893,1003894,1004702,1004707,1006536,1006538,1007391,1007450,1007454,1007493,1007494,1007495,996524,998516,999661
CVE References: CVE-2016-7161,CVE-2016-7170,CVE-2016-7421,CVE-2016-7466,CVE-2016-7908,CVE-2016-7909,CVE-2016-8576,CVE-2016-8577,CVE-2016-8578,CVE-2016-8667,CVE-2016-8669,CVE-2016-8909,CVE-2016-8910,CVE-2016-9101,CVE-2016-9102,CVE-2016-9103,CVE-2016-9104,CVE-2016-9105,CVE-2016-9106
Sources used:
openSUSE Leap 42.1 (src):    qemu-2.3.1-22.1, qemu-linux-user-2.3.1-22.1, qemu-testsuite-2.3.1-22.2
Comment 8 Swamp Workflow Management 2016-12-22 14:14:02 UTC
openSUSE-SU-2016:3237-1: An update that solves 21 vulnerabilities and has 5 fixes is now available.

Category: security (moderate)
Bug References: 1000345,1000346,1001151,1002116,1002549,1002550,1002557,1003612,1003613,1003878,1003893,1003894,1004702,1004706,1004707,1005353,1005374,1006536,1006538,1007391,1007493,1007494,1007495,1007769,1008148,998516
CVE References: CVE-2016-7161,CVE-2016-7170,CVE-2016-7422,CVE-2016-7466,CVE-2016-7907,CVE-2016-7908,CVE-2016-7909,CVE-2016-7994,CVE-2016-7995,CVE-2016-8576,CVE-2016-8577,CVE-2016-8578,CVE-2016-8667,CVE-2016-8668,CVE-2016-8669,CVE-2016-8909,CVE-2016-8910,CVE-2016-9101,CVE-2016-9104,CVE-2016-9105,CVE-2016-9106
Sources used:
openSUSE Leap 42.2 (src):    qemu-2.6.2-23.1, qemu-linux-user-2.6.2-23.1, qemu-testsuite-2.6.2-23.1
Comment 9 Bruce Rogers 2017-03-08 16:44:37 UTC
Fixed.