Bug 1146873 (CVE-2019-12068) - VUL-0: CVE-2019-12068: kvm,qemu: infinite loop while executing script
Summary: VUL-0: CVE-2019-12068: kvm,qemu: infinite loop while executing script
Status: RESOLVED FIXED
Alias: CVE-2019-12068
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/239441/
Whiteboard: CVSSv3:SUSE:CVE-2019-12068:4.4:(AV:L/...
Keywords:
Depends on:
Blocks:
 
Reported: 2019-08-22 14:23 UTC by Alexandros Toptsoglou
Modified: 2022-05-02 12:33 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandros Toptsoglou 2019-08-22 14:23:04 UTC
CVE-2019-12068

scsi: lsi: exit infinite loop while executing script

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12068
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12068.html
Comment 1 Alexandros Toptsoglou 2019-08-22 14:27:49 UTC
Based on the applicability of the fix [1] all the versions of qemu and kvm are tracked as affected.
Comment 2 Alexandros Toptsoglou 2019-08-22 14:31:17 UTC
(In reply to Alexandros Toptsoglou from comment #1)
> Based on the applicability of the fix [1] all the versions of qemu and kvm
> are tracked as affected.

[1] https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01518.html
Comment 3 Bruce Rogers 2019-11-04 22:05:21 UTC
This ended up a somewhat different patch, as commit de594e47659029316bbf9391efb79da0a1a08e08
Comment 7 Swamp Workflow Management 2019-11-13 00:01:22 UTC
SUSE-SU-2019:2955-1: An update that solves 6 vulnerabilities and has 8 fixes is now available.

Category: security (important)
Bug References: 1079730,1098403,1111025,1117665,1119991,1143794,1144087,1145379,1145427,1145436,1145774,1146873,1149811,1152506
CVE References: CVE-2018-12207,CVE-2018-20126,CVE-2019-11135,CVE-2019-12068,CVE-2019-14378,CVE-2019-15890
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP1 (src):    qemu-3.1.1.1-9.6.2
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    qemu-3.1.1.1-9.6.2, qemu-linux-user-3.1.1.1-9.6.2
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    qemu-3.1.1.1-9.6.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Swamp Workflow Management 2019-11-13 01:09:59 UTC
SUSE-SU-2019:2956-1: An update that solves four vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1119991,1146873,1152506,1153358,1155812
CVE References: CVE-2018-12207,CVE-2018-20126,CVE-2019-11135,CVE-2019-12068
Sources used:
SUSE Linux Enterprise Server 12-SP4 (src):    qemu-2.11.2-5.23.2
SUSE Linux Enterprise Desktop 12-SP4 (src):    qemu-2.11.2-5.23.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2019-11-13 01:40:56 UTC
SUSE-SU-2019:2954-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1119991,1146873,1152506,1155812
CVE References: CVE-2018-12207,CVE-2018-20126,CVE-2019-11135,CVE-2019-12068
Sources used:
SUSE Linux Enterprise Module for Server Applications 15 (src):    qemu-2.11.2-9.33.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    qemu-2.11.2-9.33.1, qemu-linux-user-2.11.2-9.33.1
SUSE Linux Enterprise Module for Basesystem 15 (src):    qemu-2.11.2-9.33.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2019-11-14 11:16:28 UTC
openSUSE-SU-2019:2510-1: An update that solves 6 vulnerabilities and has 8 fixes is now available.

Category: security (important)
Bug References: 1079730,1098403,1111025,1117665,1119991,1143794,1144087,1145379,1145427,1145436,1145774,1146873,1149811,1152506
CVE References: CVE-2018-12207,CVE-2018-20126,CVE-2019-11135,CVE-2019-12068,CVE-2019-14378,CVE-2019-15890
Sources used:
openSUSE Leap 15.1 (src):    qemu-3.1.1.1-lp151.7.6.1, qemu-linux-user-3.1.1.1-lp151.7.6.1
Comment 11 Swamp Workflow Management 2019-11-14 14:13:34 UTC
openSUSE-SU-2019:2505-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1119991,1146873,1152506,1155812
CVE References: CVE-2018-12207,CVE-2018-20126,CVE-2019-11135,CVE-2019-12068
Sources used:
openSUSE Leap 15.0 (src):    qemu-2.11.2-lp150.7.28.1
Comment 13 Swamp Workflow Management 2020-06-02 13:15:33 UTC
SUSE-SU-2020:1514-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1123156,1146873,1149811,1161066,1163018,1166240,1170940
CVE References: CVE-2019-12068,CVE-2019-15890,CVE-2019-6778,CVE-2020-1711,CVE-2020-1983,CVE-2020-7039,CVE-2020-8608
Sources used:
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    qemu-2.3.1-33.29.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    qemu-2.3.1-33.29.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2020-06-03 13:18:35 UTC
SUSE-SU-2020:1526-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1123156,1146873,1149811,1161066,1163018,1166240,1170940
CVE References: CVE-2019-12068,CVE-2019-15890,CVE-2019-6778,CVE-2020-1711,CVE-2020-1983,CVE-2020-7039,CVE-2020-8608
Sources used:
SUSE OpenStack Cloud 7 (src):    qemu-2.6.2-41.59.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    qemu-2.6.2-41.59.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    qemu-2.6.2-41.59.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    qemu-2.6.2-41.59.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Swamp Workflow Management 2020-06-04 16:17:10 UTC
SUSE-SU-2020:1538-1: An update that solves 7 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1123156,1146873,1149811,1160024,1161066,1163018,1166240,1170940
CVE References: CVE-2019-12068,CVE-2019-15890,CVE-2019-6778,CVE-2020-1711,CVE-2020-1983,CVE-2020-7039,CVE-2020-8608
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    qemu-2.9.1-6.44.1
SUSE OpenStack Cloud 8 (src):    qemu-2.9.1-6.44.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    qemu-2.9.1-6.44.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    qemu-2.9.1-6.44.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    qemu-2.9.1-6.44.1
SUSE Enterprise Storage 5 (src):    qemu-2.9.1-6.44.1
HPE Helion Openstack 8 (src):    qemu-2.9.1-6.44.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 Swamp Workflow Management 2020-06-11 19:12:29 UTC
SUSE-SU-2020:14396-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1123156,1146873,1149811,1161066,1163018,1170940
CVE References: CVE-2019-12068,CVE-2019-15890,CVE-2019-6778,CVE-2020-1983,CVE-2020-7039,CVE-2020-8608
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    kvm-1.4.2-60.31.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 19 Bruce Rogers 2021-04-07 00:33:52 UTC
Fix submitted in maintenance requests everywhere we intend to fix. Returning back to security team.
Comment 20 Swamp Workflow Management 2021-04-23 19:17:51 UTC
SUSE-SU-2021:14706-1: An update that fixes 21 vulnerabilities is now available.

Category: security (important)
Bug References: 1123156,1146873,1149811,1161066,1163018,1170940,1172383,1172384,1172385,1172478,1175441,1176673,1176682,1176684,1178934,1179467,1181108,1182137,1182425,1182577
CVE References: CVE-2014-3689,CVE-2015-1779,CVE-2019-12068,CVE-2019-15890,CVE-2019-6778,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13765,CVE-2020-14364,CVE-2020-1983,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-29130,CVE-2020-29443,CVE-2020-7039,CVE-2020-8608,CVE-2021-20181,CVE-2021-20257
JIRA References: 
Sources used:
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    kvm-1.4.2-53.38.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 22 Gabriele Sonnu 2022-05-02 12:33:56 UTC
Done.