Bug 1114423 - VUL-0: CVE-2018-18849: xen: QEMU: lsi53c895a: OOB msg buffer access leads to DoS
Summary: VUL-0: CVE-2018-18849: xen: QEMU: lsi53c895a: OOB msg buffer access leads to DoS
Status: RESOLVED FIXED
Alias: None
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Charles Arnold
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/218467/
Whiteboard: CVSSv3:SUSE:CVE-2018-18849:6.4:(AV:L/...
Keywords:
Depends on:
Blocks:
 
Reported: 2018-11-02 09:17 UTC by Marcus Meissner
Modified: 2021-01-21 18:21 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2018-11-02 09:17:07 UTC
+++ This bug was initially created as a clone of Bug #1114422 +++

rh#1644973

An out of bounds memory access issue was found in the LSI53C895A SCSI Host Bus Adapter emulation while writing a message in lsi_do_msgin. It could occur during migration if the 'msg_len' field has an invalid value.  A user/process could use this flaw to crash the Qemu process resulting in DoS.

Upstream patch:
---------------
  -> https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06682.html

Reference:
----------
  -> https://www.openwall.com/lists/oss-security/2018/11/01/1

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1644973
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18849
http://seclists.org/oss-sec/2018/q4/120
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-18849.html
https://lists.gnu.org/archive/html/qemu-devel/2018-10/msg06682.html
Comment 1 Marcus Meissner 2018-11-02 09:43:12 UTC
problem is even in very old qemu versions, so all affected I think.
Comment 3 Swamp Workflow Management 2018-12-12 08:10:23 UTC
SUSE-SU-2018:4070-1: An update that solves 6 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1027519,1108940,1114405,1114423,1115040,1115045,1115047
CVE References: CVE-2018-18849,CVE-2018-18883,CVE-2018-19961,CVE-2018-19962,CVE-2018-19965,CVE-2018-19966
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    xen-4.9.3_03-3.47.1
SUSE Linux Enterprise Server 12-SP3 (src):    xen-4.9.3_03-3.47.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    xen-4.9.3_03-3.47.1
SUSE CaaS Platform ALL (src):    xen-4.9.3_03-3.47.1
SUSE CaaS Platform 3.0 (src):    xen-4.9.3_03-3.47.1
Comment 4 Swamp Workflow Management 2018-12-13 02:18:38 UTC
openSUSE-SU-2018:4111-1: An update that solves 6 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1027519,1108940,1114405,1114423,1115040,1115045,1115047
CVE References: CVE-2018-18849,CVE-2018-18883,CVE-2018-19961,CVE-2018-19962,CVE-2018-19965,CVE-2018-19966
Sources used:
openSUSE Leap 42.3 (src):    xen-4.9.3_03-34.1
Comment 6 Swamp Workflow Management 2019-01-02 19:09:19 UTC
SUSE-SU-2019:0003-1: An update that solves 11 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1027519,1108940,1111014,1114405,1114423,1114988,1115040,1115043,1115044,1115045,1115047,1117756
CVE References: CVE-2018-17963,CVE-2018-18849,CVE-2018-18883,CVE-2018-19665,CVE-2018-19961,CVE-2018-19962,CVE-2018-19963,CVE-2018-19964,CVE-2018-19965,CVE-2018-19966,CVE-2018-19967
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    xen-4.11.1_02-2.3.1
SUSE Linux Enterprise Server 12-SP4 (src):    xen-4.11.1_02-2.3.1
SUSE Linux Enterprise Desktop 12-SP4 (src):    xen-4.11.1_02-2.3.1
Comment 7 Swamp Workflow Management 2019-01-04 17:12:42 UTC
SUSE-SU-2019:0020-1: An update that solves 6 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1027519,1105528,1108940,1114423,1115040,1115045,1115047,1116380,1117756
CVE References: CVE-2018-18849,CVE-2018-19665,CVE-2018-19961,CVE-2018-19962,CVE-2018-19965,CVE-2018-19966
Sources used:
SUSE OpenStack Cloud 7 (src):    xen-4.7.6_05-43.45.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    xen-4.7.6_05-43.45.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    xen-4.7.6_05-43.45.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    xen-4.7.6_05-43.45.1
SUSE Enterprise Storage 4 (src):    xen-4.7.6_05-43.45.1
Comment 10 Swamp Workflow Management 2019-04-01 13:19:58 UTC
SUSE-SU-2019:0827-1: An update that solves 15 vulnerabilities and has 10 fixes is now available.

Category: security (important)
Bug References: 1027519,1056336,1105528,1108940,1110924,1111007,1111011,1111014,1112188,1114423,1114988,1115040,1115045,1115047,1117756,1123157,1126140,1126141,1126192,1126195,1126196,1126198,1126201,1127400,1129623
CVE References: CVE-2017-13672,CVE-2018-10839,CVE-2018-17958,CVE-2018-17962,CVE-2018-17963,CVE-2018-18438,CVE-2018-18849,CVE-2018-19665,CVE-2018-19961,CVE-2018-19962,CVE-2018-19965,CVE-2018-19966,CVE-2018-19967,CVE-2019-6778,CVE-2019-9824
Sources used:
SUSE Linux Enterprise Server 12-LTSS (src):    xen-4.4.4_40-22.77.1

*** NOTE: This information is not intended to be used for external
    communication, because this may only be a partial fix.
    If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2019-04-01 13:23:18 UTC
SUSE-SU-2019:0825-1: An update that solves 14 vulnerabilities and has 5 fixes is now available.

Category: security (important)
Bug References: 1056336,1110924,1111007,1111011,1111014,1112188,1114423,1114988,1115040,1115047,1117756,1123157,1126140,1126141,1126192,1126195,1126196,1126201,1129623
CVE References: CVE-2017-13672,CVE-2018-10839,CVE-2018-17958,CVE-2018-17962,CVE-2018-17963,CVE-2018-18438,CVE-2018-18849,CVE-2018-19665,CVE-2018-19961,CVE-2018-19962,CVE-2018-19966,CVE-2018-19967,CVE-2019-6778,CVE-2019-9824
Sources used:
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    xen-4.5.5_28-22.58.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    xen-4.5.5_28-22.58.1

*** NOTE: This information is not intended to be used for external
    communication, because this may only be a partial fix.
    If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2019-04-03 13:10:32 UTC
SUSE-SU-2019:14011-1: An update that solves 14 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1110924,1111007,1111011,1111014,1112188,1114423,1114988,1115040,1115045,1115047,1117756,1123157,1126140,1126141,1126192,1126195,1126196,1129623
CVE References: CVE-2018-10839,CVE-2018-17958,CVE-2018-17962,CVE-2018-17963,CVE-2018-18438,CVE-2018-18849,CVE-2018-19665,CVE-2018-19961,CVE-2018-19962,CVE-2018-19965,CVE-2018-19966,CVE-2018-19967,CVE-2019-6778,CVE-2019-9824
Sources used:
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    xen-4.2.5_21-45.30.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    xen-4.2.5_21-45.30.1

*** NOTE: This information is not intended to be used for external
    communication, because this may only be a partial fix.
    If you have questions please reach out to maintenance coordination.
Comment 13 Marcus Meissner 2019-08-30 15:15:35 UTC
released