Bug 1098735 (CVE-2018-12617) - VUL-0: CVE-2018-12617: kvm,qemu: qemu-guest-agent: Integer overflow causes segmentation fault in qmp_guest_file_read() with g_malloc()
Summary: VUL-0: CVE-2018-12617: kvm,qemu: qemu-guest-agent: Integer overflow causes ...
Status: RESOLVED FIXED
Alias: CVE-2018-12617
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Fei Li
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/208618/
Whiteboard: CVSSv3:RedHat:CVE-2018-12617:6.2:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2018-06-22 06:56 UTC by Marcus Meissner
Modified: 2021-05-27 12:45 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2018-06-22 06:56:29 UTC
rh#1594054

qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga
(aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a
g_malloc0() call to trigger a segmentation fault when trying to allocate a large
memory chunk. The vulnerability can be exploited by sending a crafted QMP
command (including guest-file-read with a large count value) to the agent via
the listening socket.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1594054
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-12617
http://www.cvedetails.com/cve/CVE-2018-12617/
https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg03385.html
https://gist.github.com/fakhrizulkifli/c7740d28efa07dafee66d4da5d857ef6
Comment 1 Fei Li 2018-07-24 12:35:32 UTC
This is fixed by upstream commit: 141b197408ab398c4f474ac1a728ab316e921f2b

And it is caused by commit fa193594fbc27fde7c9062b3bf5c232534887ec7 (tag v2.3.0), so SLE12SP1/SP2/SP3/SP4 and SLE15 are affected.
Comment 2 Johannes Segitz 2018-07-26 14:38:07 UTC
(In reply to Fei Li from comment #1)
thanks. Can you please submit for this? Thank you
Comment 3 Fei Li 2018-07-31 11:57:48 UTC
(In reply to Johannes Segitz from comment #2)
> (In reply to Fei Li from comment #1)
> thanks. Can you please submit for this? Thank you

I submit the SR for all affected today. And we will send the MRs including all security fixes and some Spectre fixes together later. :)

BTW, comment#1 is not that correct. SLE12/SLE11-SP4/SLE11-SP3 code also need to be fixed although only for qga/commands-posix.c but not for qga/commands-win32.c. This is because in qga/commands-win32.c, related code is added since fa193594fbc27fde7c9062b3bf5c232534887ec7 (tag v2.3.0).
Comment 5 Fei Li 2018-08-18 11:46:26 UTC
Submitted for SLE11* & SLE12* & SLE15. So close it.
Comment 7 Swamp Workflow Management 2018-08-30 10:17:49 UTC
SUSE-SU-2018:2556-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1092885,1096223,1098735
CVE References: CVE-2018-11806,CVE-2018-12617,CVE-2018-3639
Sources used:
SUSE Linux Enterprise Server 12-LTSS (src):    qemu-2.0.2-48.43.3
Comment 8 Swamp Workflow Management 2018-08-30 22:08:55 UTC
SUSE-SU-2018:2565-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1020928,1092885,1096223,1098735
CVE References: CVE-2018-11806,CVE-2018-12617,CVE-2018-3639
Sources used:
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    qemu-2.3.1-33.12.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    qemu-2.3.1-33.12.1
Comment 9 Swamp Workflow Management 2018-09-04 22:10:38 UTC
SUSE-SU-2018:2615-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1092885,1096223,1098735
CVE References: CVE-2018-11806,CVE-2018-12617,CVE-2018-3639
Sources used:
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    kvm-1.4.2-53.23.2
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    kvm-1.4.2-53.23.2
Comment 10 Swamp Workflow Management 2018-09-07 16:09:14 UTC
SUSE-SU-2018:2650-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1092885,1096223,1098735
CVE References: CVE-2018-11806,CVE-2018-12617,CVE-2018-3639
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    kvm-1.4.2-60.15.2
Comment 11 Swamp Workflow Management 2018-09-10 19:09:47 UTC
SUSE-SU-2018:2679-1: An update that solves one vulnerability and has four fixes is now available.

Category: security (moderate)
Bug References: 1094898,1098735,1102604,1103628,1105279
CVE References: CVE-2018-12617
Sources used:
SUSE Linux Enterprise Module for Server Applications 15 (src):    qemu-2.11.2-9.9.1
SUSE Linux Enterprise Module for Basesystem 15 (src):    qemu-2.11.2-9.9.1
Comment 12 Swamp Workflow Management 2018-09-12 10:08:15 UTC
openSUSE-SU-2018:2693-1: An update that solves one vulnerability and has four fixes is now available.

Category: security (moderate)
Bug References: 1094898,1098735,1102604,1103628,1105279
CVE References: CVE-2018-12617
Sources used:
openSUSE Leap 15.0 (src):    qemu-2.11.2-lp150.7.9.1, qemu-linux-user-2.11.2-lp150.7.9.1, qemu-testsuite-2.11.2-lp150.7.9.1
Comment 13 Swamp Workflow Management 2018-10-02 16:09:05 UTC
SUSE-SU-2018:2973-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1092885,1096223,1098735
CVE References: CVE-2018-11806,CVE-2018-12617,CVE-2018-3639
Sources used:
SUSE OpenStack Cloud 7 (src):    qemu-2.6.2-41.43.3
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    qemu-2.6.2-41.43.3
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    qemu-2.6.2-41.43.3
SUSE Enterprise Storage 4 (src):    qemu-2.6.2-41.43.3
Comment 14 Swamp Workflow Management 2018-10-18 17:19:21 UTC
SUSE-SU-2018:2973-2: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1092885,1096223,1098735
CVE References: CVE-2018-11806,CVE-2018-12617,CVE-2018-3639
Sources used:
SUSE Linux Enterprise Server 12-SP2-BCL (src):    qemu-2.6.2-41.43.3
Comment 15 Swamp Workflow Management 2018-10-29 20:15:44 UTC
SUSE-SU-2018:3555-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1092885,1094725,1096223,1098735
CVE References: CVE-2018-11806,CVE-2018-12617,CVE-2018-3639
Sources used:
SUSE Linux Enterprise Server 12-SP3 (src):    qemu-2.9.1-6.19.11
SUSE Linux Enterprise Desktop 12-SP3 (src):    qemu-2.9.1-6.19.11
SUSE CaaS Platform ALL (src):    qemu-2.9.1-6.19.11
SUSE CaaS Platform 3.0 (src):    qemu-2.9.1-6.19.11
Comment 16 Swamp Workflow Management 2018-11-09 23:24:40 UTC
openSUSE-SU-2018:3709-1: An update that solves three vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1092885,1094725,1096223,1098735
CVE References: CVE-2018-11806,CVE-2018-12617,CVE-2018-3639
Sources used:
openSUSE Leap 42.3 (src):    qemu-2.9.1-47.1, qemu-linux-user-2.9.1-47.1, qemu-testsuite-2.9.1-47.2