Bug 1123156 (CVE-2019-6778)

Summary:	VUL-0: CVE-2019-6778: kvm,qemu: A heap buffer overflow in tcp_emu() found in slirp
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Alexandros Toptsoglou <atoptsoglou>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	brogers, carlos.lopez, smash_bz
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/223717/
Whiteboard:	CVSSv3:SUSE:CVE-2019-6778:7.8:(AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Alexandros Toptsoglou 2019-01-25 10:59:46 UTC

CVE-2019-6778
-------------

A heap buffer overflow issue was found in the SLiRP networking implementation
of the QEMU emulator. It occurs in tcp_emu() routine while emulating
Identification protocol and copying message data to a socket buffer. 

A user/process could use this flaw to crash the Qemu process on the host
resulting in DoS or potentially execute arbitrary code with privileges of the 
QEMU process.

Upstream patch:
---------------
  -> https://lists.gnu.org/archive/html/qemu-devel/2019-01/msg03132.html

Reference:
----------
  -> https://www.openwall.com/lists/oss-security/2019/01/24/5

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1664205
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-6778
http://seclists.org/oss-sec/2019/q1/93
https://lists.gnu.org/archive/html/qemu-devel/2019-01/msg03132.html

Comment 1 Alexandros Toptsoglou 2019-01-25 11:01:31 UTC

All the codestreams are affected. The fix is available at [1] 

[1]  https://lists.gnu.org/archive/html/qemu-devel/2019-01/msg03132.html

Comment 2 Alexandros Toptsoglou 2019-01-25 11:10:10 UTC

Bug for xen is tracked at:
https://bugzilla.suse.com/show_bug.cgi?id=1123157

Comment 3 Bruce Rogers 2019-01-25 19:06:26 UTC

This fix is upstream commit a7104eda7dab99d0cdbd3595c211864cba415905

Comment 4 Bruce Rogers 2019-01-25 23:24:49 UTC

Fix is checked in for the following releases:

Factory/SLE15-SP3 pre-release
SLE15
SLE12-SP4
SLE12-SP3
SLE12-SP2
SLE12-SP1
SLE12
SLE11-SP4
SLE11-SP3

That should cover all SLE release needing this fix.

Comment 6 Swamp Workflow Management 2019-02-15 14:14:14 UTC

SUSE-SU-2019:13962-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1109544,1116717,1117275,1123156
CVE References: CVE-2018-19364,CVE-2018-19489,CVE-2019-6778
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    kvm-1.4.2-60.21.1

Comment 7 Swamp Workflow Management 2019-02-18 20:14:12 UTC

SUSE-SU-2019:0423-1: An update that solves 5 vulnerabilities and has 7 fixes is now available.

Category: security (important)
Bug References: 1063993,1079730,1100408,1101982,1112646,1114957,1116717,1117275,1119493,1121600,1123156,1123179
CVE References: CVE-2018-16872,CVE-2018-18954,CVE-2018-19364,CVE-2018-19489,CVE-2019-6778
Sources used:
SUSE Linux Enterprise Module for Server Applications 15 (src):    qemu-2.11.2-9.20.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    qemu-2.11.2-9.20.1, qemu-linux-user-2.11.2-9.20.1
SUSE Linux Enterprise Module for Basesystem 15 (src):    qemu-2.11.2-9.20.1

Comment 8 Swamp Workflow Management 2019-02-19 17:14:22 UTC

SUSE-SU-2019:0435-1: An update that solves 5 vulnerabilities and has 7 fixes is now available.

Category: security (important)
Bug References: 1063993,1079730,1100408,1101982,1112646,1114957,1116717,1117275,1119493,1121600,1123156,1123179
CVE References: CVE-2018-16872,CVE-2018-18954,CVE-2018-19364,CVE-2018-19489,CVE-2019-6778
Sources used:
SUSE Linux Enterprise Server 12-SP4 (src):    qemu-2.11.2-5.8.1
SUSE Linux Enterprise Desktop 12-SP4 (src):    qemu-2.11.2-5.8.1

Comment 9 Swamp Workflow Management 2019-02-21 11:10:55 UTC

SUSE-SU-2019:0457-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1116717,1117275,1123156
CVE References: CVE-2018-19364,CVE-2018-19489,CVE-2019-6778
Sources used:
SUSE Linux Enterprise Server 12-LTSS (src):    qemu-2.0.2-48.49.3

Comment 10 Swamp Workflow Management 2019-02-22 17:10:14 UTC

SUSE-SU-2019:0471-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1116717,1117275,1119493,1123156
CVE References: CVE-2018-16872,CVE-2018-19364,CVE-2018-19489,CVE-2019-6778
Sources used:
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    qemu-2.3.1-33.20.1

Comment 11 Swamp Workflow Management 2019-02-26 11:13:54 UTC

SUSE-SU-2019:0489-1: An update that fixes 7 vulnerabilities is now available.

Category: security (important)
Bug References: 1084604,1113231,1116717,1117275,1119493,1123156
CVE References: CVE-2017-13672,CVE-2017-13673,CVE-2018-16872,CVE-2018-19364,CVE-2018-19489,CVE-2018-7858,CVE-2019-6778
Sources used:
SUSE OpenStack Cloud 7 (src):    qemu-2.6.2-41.49.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    qemu-2.6.2-41.49.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    qemu-2.6.2-41.49.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    qemu-2.6.2-41.49.1
SUSE Enterprise Storage 4 (src):    qemu-2.6.2-41.49.1

Comment 12 Swamp Workflow Management 2019-02-27 11:22:58 UTC

openSUSE-SU-2019:0254-1: An update that solves 5 vulnerabilities and has 7 fixes is now available.

Category: security (important)
Bug References: 1063993,1079730,1100408,1101982,1112646,1114957,1116717,1117275,1119493,1121600,1123156,1123179
CVE References: CVE-2018-16872,CVE-2018-18954,CVE-2018-19364,CVE-2018-19489,CVE-2019-6778
Sources used:
openSUSE Leap 15.0 (src):    qemu-2.11.2-lp150.7.18.1, qemu-linux-user-2.11.2-lp150.7.18.1, qemu-testsuite-2.11.2-lp150.7.18.1

Comment 13 Swamp Workflow Management 2019-03-11 23:10:30 UTC

SUSE-SU-2019:0582-1: An update that solves 8 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1056334,1056386,1084604,1113231,1114957,1116717,1117275,1119493,1121600,1123156
CVE References: CVE-2017-13672,CVE-2017-13673,CVE-2018-16872,CVE-2018-18954,CVE-2018-19364,CVE-2018-19489,CVE-2018-7858,CVE-2019-6778
Sources used:
SUSE Linux Enterprise Server 12-SP3 (src):    qemu-2.9.1-6.28.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    qemu-2.9.1-6.28.1
SUSE CaaS Platform ALL (src):    qemu-2.9.1-6.28.1
SUSE CaaS Platform 3.0 (src):    qemu-2.9.1-6.28.1

Comment 14 Swamp Workflow Management 2019-03-28 23:10:57 UTC

openSUSE-SU-2019:1074-1: An update that solves 8 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1056334,1056386,1084604,1113231,1114957,1116717,1117275,1119493,1121600,1123156
CVE References: CVE-2017-13672,CVE-2017-13673,CVE-2018-16872,CVE-2018-18954,CVE-2018-19364,CVE-2018-19489,CVE-2018-7858,CVE-2019-6778
Sources used:
openSUSE Leap 42.3 (src):    qemu-2.9.1-56.1, qemu-linux-user-2.9.1-56.1, qemu-testsuite-2.9.1-56.2

*** NOTE: This information is not intended to be used for external
    communication, because this may only be a partial fix.
    If you have questions please reach out to maintenance coordination.

Comment 15 Swamp Workflow Management 2019-04-27 22:15:38 UTC

SUSE-SU-2019:0471-2: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1116717,1117275,1119493,1123156
CVE References: CVE-2018-16872,CVE-2018-19364,CVE-2018-19489,CVE-2019-6778
Sources used:
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    qemu-2.3.1-33.20.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 16 Swamp Workflow Management 2019-08-27 19:11:02 UTC

SUSE-SU-2019:2223-1: An update that solves three vulnerabilities and has four fixes is now available.

Category: security (moderate)
Bug References: 1096726,1123156,1123387,1135460,1136974,1137860,1143386
CVE References: CVE-2018-15664,CVE-2019-10152,CVE-2019-6778
Sources used:
SUSE Linux Enterprise Module for Containers 15-SP1 (src):    fuse-overlayfs-0.4.1-3.3.8, fuse3-3.6.1-3.3.8, podman-1.4.4-4.8.1, slirp4netns-0.3.0-3.3.3
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    libcontainers-common-20190401-3.3.5

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 17 Swamp Workflow Management 2019-09-01 22:12:04 UTC

openSUSE-SU-2019:2044-1: An update that solves three vulnerabilities and has four fixes is now available.

Category: security (moderate)
Bug References: 1096726,1123156,1123387,1135460,1136974,1137860,1143386
CVE References: CVE-2018-15664,CVE-2019-10152,CVE-2019-6778
Sources used:
openSUSE Leap 15.1 (src):    fuse-overlayfs-0.4.1-lp151.2.1, fuse3-3.6.1-lp151.2.1, libcontainers-common-20190401-lp151.2.3.1, podman-1.4.4-lp151.3.3.1, slirp4netns-0.3.0-lp151.2.3.1

Comment 22 Bruce Rogers 2020-03-10 16:54:51 UTC

This is queued for the next maintenance update, which I should get to shortly.

Comment 25 Swamp Workflow Management 2020-04-01 19:16:05 UTC

SUSE-SU-2020:0844-1: An update that solves 6 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1123156,1154790,1161066,1162729,1163018,1165776,1166240,1166379
CVE References: CVE-2019-15034,CVE-2019-20382,CVE-2019-6778,CVE-2020-1711,CVE-2020-7039,CVE-2020-8608
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP1 (src):    qemu-3.1.1.1-9.14.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    qemu-3.1.1.1-9.14.1, qemu-linux-user-3.1.1.1-9.14.1, qemu-testsuite-3.1.1.1-9.14.2
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    qemu-3.1.1.1-9.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 26 Swamp Workflow Management 2020-04-01 19:23:03 UTC

SUSE-SU-2020:0845-1: An update that solves 6 vulnerabilities and has 6 fixes is now available.

Category: security (important)
Bug References: 1123156,1154790,1156642,1156794,1158880,1161066,1162161,1162729,1163018,1165776,1166240,1166379
CVE References: CVE-2019-15034,CVE-2019-20382,CVE-2019-6778,CVE-2020-1711,CVE-2020-7039,CVE-2020-8608
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    qemu-3.1.1.1-3.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 27 Swamp Workflow Management 2020-04-07 04:13:31 UTC

openSUSE-SU-2020:0468-1: An update that solves 6 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1123156,1154790,1161066,1162729,1163018,1165776,1166240,1166379
CVE References: CVE-2019-15034,CVE-2019-20382,CVE-2019-6778,CVE-2020-1711,CVE-2020-7039,CVE-2020-8608
Sources used:
openSUSE Leap 15.1 (src):    qemu-3.1.1.1-lp151.7.12.1, qemu-linux-user-3.1.1.1-lp151.7.12.1

Comment 29 Swamp Workflow Management 2020-05-28 19:13:08 UTC

SUSE-SU-2020:1501-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1123156,1161066,1163018,1165776,1166240,1170940
CVE References: CVE-2019-20382,CVE-2019-6778,CVE-2020-1711,CVE-2020-1983,CVE-2020-7039,CVE-2020-8608
Sources used:
SUSE Linux Enterprise Server 12-SP4 (src):    qemu-2.11.2-5.26.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 30 Swamp Workflow Management 2020-06-02 13:15:27 UTC

SUSE-SU-2020:1514-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1123156,1146873,1149811,1161066,1163018,1166240,1170940
CVE References: CVE-2019-12068,CVE-2019-15890,CVE-2019-6778,CVE-2020-1711,CVE-2020-1983,CVE-2020-7039,CVE-2020-8608
Sources used:
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    qemu-2.3.1-33.29.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    qemu-2.3.1-33.29.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 31 Swamp Workflow Management 2020-06-03 10:15:14 UTC

SUSE-SU-2020:1523-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1123156,1161066,1163018,1165776,1166240,1170940
CVE References: CVE-2019-20382,CVE-2019-6778,CVE-2020-1711,CVE-2020-1983,CVE-2020-7039,CVE-2020-8608
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    qemu-2.11.2-9.36.1
SUSE Linux Enterprise Server 15-LTSS (src):    qemu-2.11.2-9.36.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    qemu-2.11.2-9.36.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    qemu-2.11.2-9.36.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 32 Swamp Workflow Management 2020-06-03 13:18:29 UTC

SUSE-SU-2020:1526-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1123156,1146873,1149811,1161066,1163018,1166240,1170940
CVE References: CVE-2019-12068,CVE-2019-15890,CVE-2019-6778,CVE-2020-1711,CVE-2020-1983,CVE-2020-7039,CVE-2020-8608
Sources used:
SUSE OpenStack Cloud 7 (src):    qemu-2.6.2-41.59.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    qemu-2.6.2-41.59.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    qemu-2.6.2-41.59.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    qemu-2.6.2-41.59.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 33 Swamp Workflow Management 2020-06-04 16:17:03 UTC

SUSE-SU-2020:1538-1: An update that solves 7 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1123156,1146873,1149811,1160024,1161066,1163018,1166240,1170940
CVE References: CVE-2019-12068,CVE-2019-15890,CVE-2019-6778,CVE-2020-1711,CVE-2020-1983,CVE-2020-7039,CVE-2020-8608
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    qemu-2.9.1-6.44.1
SUSE OpenStack Cloud 8 (src):    qemu-2.9.1-6.44.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    qemu-2.9.1-6.44.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    qemu-2.9.1-6.44.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    qemu-2.9.1-6.44.1
SUSE Enterprise Storage 5 (src):    qemu-2.9.1-6.44.1
HPE Helion Openstack 8 (src):    qemu-2.9.1-6.44.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 34 Swamp Workflow Management 2020-06-11 19:12:23 UTC

SUSE-SU-2020:14396-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1123156,1146873,1149811,1161066,1163018,1170940
CVE References: CVE-2019-12068,CVE-2019-15890,CVE-2019-6778,CVE-2020-1983,CVE-2020-7039,CVE-2020-8608
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    kvm-1.4.2-60.31.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 37 Swamp Workflow Management 2021-04-23 19:17:46 UTC

SUSE-SU-2021:14706-1: An update that fixes 21 vulnerabilities is now available.

Category: security (important)
Bug References: 1123156,1146873,1149811,1161066,1163018,1170940,1172383,1172384,1172385,1172478,1175441,1176673,1176682,1176684,1178934,1179467,1181108,1182137,1182425,1182577
CVE References: CVE-2014-3689,CVE-2015-1779,CVE-2019-12068,CVE-2019-15890,CVE-2019-6778,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13765,CVE-2020-14364,CVE-2020-1983,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-29130,CVE-2020-29443,CVE-2020-7039,CVE-2020-8608,CVE-2021-20181,CVE-2021-20257
JIRA References: 
Sources used:
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    kvm-1.4.2-53.38.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 39 José Ricardo Ziviani 2021-07-23 21:07:27 UTC

Fix included in maintenance request for all affected releases. Returning to security-team.

Thank you!

Jose

Comment 40 Carlos López 2022-06-10 09:08:20 UTC

Done, closing.