Bug 1114422 (CVE-2018-18849) - VUL-0: CVE-2018-18849: kvm,qemu: QEMU: lsi53c895a: OOB msg buffer access leads to DoS
Summary: VUL-0: CVE-2018-18849: kvm,qemu: QEMU: lsi53c895a: OOB msg buffer access lead...
Status: RESOLVED FIXED
Alias: CVE-2018-18849
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Bruce Rogers
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/218467/
Whiteboard: CVSSv3:RedHat:CVE-2018-18849:6.4:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2018-11-02 09:15 UTC by Marcus Meissner
Modified: 2021-05-27 12:46 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2018-11-02 09:15:56 UTC
rh#1644973

An out of bounds memory access issue was found in the LSI53C895A SCSI Host Bus Adapter emulation while writing a message in lsi_do_msgin. It could occur during migration if the 'msg_len' field has an invalid value.  A user/process could use this flaw to crash the Qemu process resulting in DoS.

Upstream patch:
---------------
  -> https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06682.html

Reference:
----------
  -> https://www.openwall.com/lists/oss-security/2018/11/01/1

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1644973
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18849
http://seclists.org/oss-sec/2018/q4/120
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-18849.html
https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06682.html
Comment 1 Marcus Meissner 2018-11-02 09:43:30 UTC
problem already in old qemu versions, so all versions affected I think.
Comment 4 Swamp Workflow Management 2018-11-26 20:13:06 UTC
SUSE-SU-2018:3912-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1106222,1110910,1111006,1111010,1111013,1114422
CVE References: CVE-2018-10839,CVE-2018-15746,CVE-2018-17958,CVE-2018-17962,CVE-2018-17963,CVE-2018-18849
Sources used:
SUSE Linux Enterprise Server 12-LTSS (src):    qemu-2.0.2-48.46.2
Comment 6 Swamp Workflow Management 2018-11-27 17:14:43 UTC
SUSE-SU-2018:3927-1: An update that solves 7 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1106222,1107489,1110910,1111006,1111010,1111013,1112499,1114422,1114529
CVE References: CVE-2018-10839,CVE-2018-15746,CVE-2018-16847,CVE-2018-17958,CVE-2018-17962,CVE-2018-17963,CVE-2018-18849
Sources used:
SUSE Linux Enterprise Module for Server Applications 15 (src):    qemu-2.11.2-9.12.2
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    qemu-2.11.2-9.12.2, qemu-linux-user-2.11.2-9.12.1
SUSE Linux Enterprise Module for Basesystem 15 (src):    qemu-2.11.2-9.12.2
Comment 7 Swamp Workflow Management 2018-12-04 20:11:50 UTC
SUSE-SU-2018:3973-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1106222,1110910,1111006,1111010,1111013,1114422
CVE References: CVE-2018-10839,CVE-2018-15746,CVE-2018-17958,CVE-2018-17962,CVE-2018-17963,CVE-2018-18849
Sources used:
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    qemu-2.3.1-33.17.1
Comment 8 Swamp Workflow Management 2018-12-04 20:14:12 UTC
SUSE-SU-2018:3975-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1106222,1110910,1111006,1111010,1111013,1112185,1114422
CVE References: CVE-2018-10839,CVE-2018-15746,CVE-2018-17958,CVE-2018-17962,CVE-2018-17963,CVE-2018-18438,CVE-2018-18849
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    kvm-1.4.2-60.18.2
Comment 9 Swamp Workflow Management 2018-12-05 17:12:48 UTC
SUSE-SU-2018:3987-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1106222,1110910,1111006,1111010,1111013,1112185,1114422
CVE References: CVE-2018-10839,CVE-2018-15746,CVE-2018-17958,CVE-2018-17962,CVE-2018-17963,CVE-2018-18438,CVE-2018-18849
Sources used:
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    kvm-1.4.2-53.26.2
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    kvm-1.4.2-53.26.2
Comment 10 Swamp Workflow Management 2018-12-07 11:24:37 UTC
openSUSE-SU-2018:4004-1: An update that solves 7 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1106222,1107489,1110910,1111006,1111010,1111013,1112499,1114422,1114529
CVE References: CVE-2018-10839,CVE-2018-15746,CVE-2018-16847,CVE-2018-17958,CVE-2018-17962,CVE-2018-17963,CVE-2018-18849
Sources used:
openSUSE Leap 15.0 (src):    qemu-2.11.2-lp150.7.12.1, qemu-linux-user-2.11.2-lp150.7.12.1, qemu-testsuite-2.11.2-lp150.7.12.1
Comment 11 Swamp Workflow Management 2018-12-14 20:10:51 UTC
SUSE-SU-2018:4129-1: An update that solves 6 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1100408,1106222,1110910,1111006,1111010,1111013,1114422
CVE References: CVE-2018-10839,CVE-2018-15746,CVE-2018-17958,CVE-2018-17962,CVE-2018-17963,CVE-2018-18849
Sources used:
SUSE Linux Enterprise Server 12-SP3 (src):    qemu-2.9.1-6.22.3
SUSE Linux Enterprise Desktop 12-SP3 (src):    qemu-2.9.1-6.22.3
SUSE CaaS Platform ALL (src):    qemu-2.9.1-6.22.3
SUSE CaaS Platform 3.0 (src):    qemu-2.9.1-6.22.3
Comment 12 Swamp Workflow Management 2018-12-15 23:10:38 UTC
openSUSE-SU-2018:4147-1: An update that solves 6 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1100408,1106222,1110910,1111006,1111010,1111013,1114422
CVE References: CVE-2018-10839,CVE-2018-15746,CVE-2018-17958,CVE-2018-17962,CVE-2018-17963,CVE-2018-18849
Sources used:
openSUSE Leap 42.3 (src):    qemu-2.9.1-50.1, qemu-linux-user-2.9.1-50.1, qemu-testsuite-2.9.1-50.1
Comment 13 Swamp Workflow Management 2018-12-19 14:13:45 UTC
SUSE-SU-2018:4185-1: An update that solves 7 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1106222,1108474,1110910,1111006,1111010,1111013,1114422,1114529
CVE References: CVE-2018-10839,CVE-2018-15746,CVE-2018-16847,CVE-2018-17958,CVE-2018-17962,CVE-2018-17963,CVE-2018-18849
Sources used:
SUSE Linux Enterprise Server 12-SP4 (src):    qemu-2.11.2-5.5.1
SUSE Linux Enterprise Desktop 12-SP4 (src):    qemu-2.11.2-5.5.1
Comment 14 Swamp Workflow Management 2018-12-22 14:09:58 UTC
SUSE-SU-2018:4237-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1106222,1110910,1111006,1111010,1111013,1114422
CVE References: CVE-2018-10839,CVE-2018-15746,CVE-2018-17958,CVE-2018-17962,CVE-2018-17963,CVE-2018-18849
Sources used:
SUSE OpenStack Cloud 7 (src):    qemu-2.6.2-41.46.2
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    qemu-2.6.2-41.46.2
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    qemu-2.6.2-41.46.2
SUSE Linux Enterprise Server 12-SP2-BCL (src):    qemu-2.6.2-41.46.2
SUSE Enterprise Storage 4 (src):    qemu-2.6.2-41.46.2
Comment 15 Bruce Rogers 2019-01-10 16:59:28 UTC
Fix is included in v3.1.0 qemu, so no additional patch needed for SLE15-SP1.
Comment 16 Bruce Rogers 2019-01-10 17:01:27 UTC
Fixed everywhere that needs it. Marking fixed accordingly.
Comment 17 Swamp Workflow Management 2019-04-27 22:36:27 UTC
SUSE-SU-2018:3973-2: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1106222,1110910,1111006,1111010,1111013,1114422
CVE References: CVE-2018-10839,CVE-2018-15746,CVE-2018-17958,CVE-2018-17962,CVE-2018-17963,CVE-2018-18849
Sources used:
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    qemu-2.3.1-33.17.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.