Bugzilla – Bug 1143794
VUL-0: CVE-2019-14378: kvm,qemu: heap buffer overflow during packet reassembly in slirp networking implementation
Last modified: 2022-06-10 09:09:43 UTC
CVE-2019-14378 A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. It occurs in ip_reass() routine while reassembling incoming packets, if the first fragment is bigger than the m->m_dat[] buffer. A user/process could use this flaw to crash the Qemu process on the host resulting in DoS or potentially execute arbitrary code with privileges of the QEMU process. Upstream patch: --------------- -> https://gitlab.freedesktop.org/slirp/libslirp/commit/126c04acbabd7ad32c2b018fe10dfac2a3bc1210 Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/08/01/2 References: https://bugzilla.redhat.com/show_bug.cgi?id=1734745 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14378 http://seclists.org/oss-sec/2019/q3/107 http://www.cvedetails.com/cve/CVE-2019-14378/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14378 https://gitlab.freedesktop.org/slirp/libslirp/commit/126c04acbabd7ad32c2b018fe10dfac2a3bc1210
All codestreams including LTSS seem affected for both kvm and qemu
All branches are patched, should be seen in next maintain release. SLES-11-SP3 SLES-11-SP4 SLES12 -- SP5 SLES15 -- SP1 tumbleweed
SUSE-SU-2019:2192-1: An update that solves four vulnerabilities and has 7 fixes is now available. Category: security (important) Bug References: 1128106,1133031,1134883,1135210,1135902,1136540,1136778,1138534,1140402,1143794,1144087 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378,CVE-2019-5008 Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP1 (src): qemu-3.1.1-9.3.3 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): qemu-3.1.1-9.3.3, qemu-linux-user-3.1.1-9.3.2, qemu-testsuite-3.1.1-9.3.4 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): qemu-3.1.1-9.3.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:14151-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1135902,1140402,1143794 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378 Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): kvm-1.4.2-60.27.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2221-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1135902,1140402,1143794 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378 Sources used: SUSE Linux Enterprise Server for SAP 12-SP1 (src): qemu-2.3.1-33.26.1 SUSE Linux Enterprise Server 12-SP1-LTSS (src): qemu-2.3.1-33.26.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2246-1: An update that solves three vulnerabilities and has 7 fixes is now available. Category: security (important) Bug References: 1079730,1098403,1111025,1119115,1134883,1135902,1136540,1136778,1140402,1143794 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378 Sources used: SUSE Linux Enterprise Module for Server Applications 15 (src): qemu-2.11.2-9.28.3 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): qemu-2.11.2-9.28.3, qemu-linux-user-2.11.2-9.28.2 SUSE Linux Enterprise Module for Basesystem 15 (src): qemu-2.11.2-9.28.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:2041-1: An update that solves four vulnerabilities and has 7 fixes is now available. Category: security (important) Bug References: 1128106,1133031,1134883,1135210,1135902,1136540,1136778,1138534,1140402,1143794,1144087 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378,CVE-2019-5008 Sources used: openSUSE Leap 15.1 (src): qemu-3.1.1-lp151.7.3.3, qemu-linux-user-3.1.1-lp151.7.3.2, qemu-testsuite-3.1.1-lp151.7.3.3
openSUSE-SU-2019:2059-1: An update that solves three vulnerabilities and has 7 fixes is now available. Category: security (important) Bug References: 1079730,1098403,1111025,1119115,1134883,1135902,1136540,1136778,1140402,1143794 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378 Sources used: openSUSE Leap 15.0 (src): qemu-2.11.2-lp150.7.25.1
SUSE-SU-2019:2278-1: An update that solves three vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 1127077,1135902,1139926,1140402,1143794 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378 Sources used: SUSE CaaS Platform 3.0 (src): qemu-2.9.1-6.41.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2157-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1135902,1140402,1143794 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378 Sources used: SUSE OpenStack Cloud 7 (src): qemu-2.6.2-41.55.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): qemu-2.6.2-41.55.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): qemu-2.6.2-41.55.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): qemu-2.6.2-41.55.1 SUSE Enterprise Storage 4 (src): qemu-2.6.2-41.55.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2353-1: An update that solves three vulnerabilities and has 9 fixes is now available. Category: security (important) Bug References: 1079730,1098403,1111025,1127077,1134880,1135902,1136528,1136777,1139926,1140402,1141043,1143794 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378 Sources used: SUSE Linux Enterprise Server 12-SP4 (src): qemu-2.11.2-5.18.1 SUSE Linux Enterprise Desktop 12-SP4 (src): qemu-2.11.2-5.18.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2955-1: An update that solves 6 vulnerabilities and has 8 fixes is now available. Category: security (important) Bug References: 1079730,1098403,1111025,1117665,1119991,1143794,1144087,1145379,1145427,1145436,1145774,1146873,1149811,1152506 CVE References: CVE-2018-12207,CVE-2018-20126,CVE-2019-11135,CVE-2019-12068,CVE-2019-14378,CVE-2019-15890 Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP1 (src): qemu-3.1.1.1-9.6.2 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): qemu-3.1.1.1-9.6.2, qemu-linux-user-3.1.1.1-9.6.2 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): qemu-3.1.1.1-9.6.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:2510-1: An update that solves 6 vulnerabilities and has 8 fixes is now available. Category: security (important) Bug References: 1079730,1098403,1111025,1117665,1119991,1143794,1144087,1145379,1145427,1145436,1145774,1146873,1149811,1152506 CVE References: CVE-2018-12207,CVE-2018-20126,CVE-2019-11135,CVE-2019-12068,CVE-2019-14378,CVE-2019-15890 Sources used: openSUSE Leap 15.1 (src): qemu-3.1.1.1-lp151.7.6.1, qemu-linux-user-3.1.1.1-lp151.7.6.1
@aginies, do we need to backport all our qemu versions? I thought LTSS only covers to 11sp3/11sp4.
We backport only on supported product. So nothing more than LTSS. SLE11SP1 and SP2 are out of scope.
Fix included in maintenance request for all affected releases. Returning to security-team. Thank you! Jose
Done, closing.