Bugzilla – Bug 1172385
VUL-0: CVE-2020-12829: qemu: OOB read and write due to integer overflow in sm501_2d_operation() in hw/display/sm501.c
Last modified: 2023-08-04 11:20:25 UTC
CVE-2020-12829 An out-of-bounds read/write vulnerability was found in function Sm501_2d_operation() in hw/display/sm501.c. The OOB flaw is caused by an integer overflow in COPY_AREA when the `rtl` parameter is set to 1, and either `src_y` or `src_x` is less than `operation_height`. References: https://bugzilla.redhat.com/show_bug.cgi?id=1786026 https://bugzilla.redhat.com/show_bug.cgi?id=1808510 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-12829 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=961451 http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-12829.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12829
The virtual SM501 device is specific to PowerPC guest systems. I'm unable to reproduce the bug with a ppc64-softmmu virtual machine. Upstream only mentions ppc (32-bit) which we don't support. We could patch the bug nevertheless but I suspect we're not affected. Please verify.
(In reply to Wolfgang Frisch from comment #1) > The virtual SM501 device is specific to PowerPC guest systems. > > I'm unable to reproduce the bug with a ppc64-softmmu virtual machine. > Upstream only mentions ppc (32-bit) which we don't support. > We could patch the bug nevertheless but I suspect we're not affected. > Please verify. I'm always interested in fixing code vulnerabilities as long as fixing it isn't riskier than the risk of leaving the vulnerability in the code. I'll watch for the fix to show up in upstream master.
Instead of a surgical fix for this issue, the file has had major changes made to it in an effort to clean up many issues found there. I'll see what parts, if any we want to take from that effort.
This commit was merged into the staging branch: https://git.qemu.org/?p=qemu.git;a=blobdiff;f=hw/display/sm501.c;h=8bf4d111f4b3848114f3edc1d539d23d65de9444;hp=5ed57703d8113777e25ebaf572cc33986b65738e;hb=b15a22bbcbe6a78dc3d88fe3134985e4cdd87de4;hpb=3d0b096298b5579a7fa0753ad90968b27bc65372
Fix is commit b15a22bbcbe6a78dc3d88fe3134985e4cdd87de4, contained in v5.1
Fixes submitted. Returning to security team.
SUSE-SU-2021:1243-1: An update that solves 15 vulnerabilities and has two fixes is now available. Category: security (important) Bug References: 1172385,1173612,1176673,1176682,1176684,1178174,1178400,1178934,1179466,1179467,1179468,1179686,1181108,1182425,1182577,1182968,1184064 CVE References: CVE-2020-12829,CVE-2020-15469,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27616,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: SUSE MicroOS 5.0 (src): qemu-4.2.1-11.16.3 SUSE Linux Enterprise Module for Server Applications 15-SP2 (src): qemu-4.2.1-11.16.3 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): qemu-4.2.1-11.16.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1245-1: An update that solves 25 vulnerabilities and has four fixes is now available. Category: security (important) Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178049,1178174,1178565,1178934,1179466,1179467,1179468,1179686,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968,1183979 CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: SUSE Manager Server 4.0 (src): qemu-3.1.1.1-9.24.3 SUSE Manager Retail Branch Server 4.0 (src): qemu-3.1.1.1-9.24.3 SUSE Manager Proxy 4.0 (src): qemu-3.1.1.1-9.24.3 SUSE Linux Enterprise Server for SAP 15-SP1 (src): qemu-3.1.1.1-9.24.3 SUSE Linux Enterprise Server 15-SP1-LTSS (src): qemu-3.1.1.1-9.24.3 SUSE Linux Enterprise Server 15-SP1-BCL (src): qemu-3.1.1.1-9.24.3 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): qemu-3.1.1.1-9.24.3 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): qemu-3.1.1.1-9.24.3 SUSE Enterprise Storage 6 (src): qemu-3.1.1.1-9.24.3 SUSE CaaS Platform 4.0 (src): qemu-3.1.1.1-9.24.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1240-1: An update that solves 22 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179467,1179468,1180523,1181108,1181639,1182137,1182425,1182577,1182968 CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 8 (src): qemu-2.9.1-6.47.1 SUSE OpenStack Cloud 8 (src): qemu-2.9.1-6.47.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): qemu-2.9.1-6.47.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): qemu-2.9.1-6.47.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): qemu-2.9.1-6.47.1 HPE Helion Openstack 8 (src): qemu-2.9.1-6.47.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1241-1: An update that solves 24 vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1112499,1119115,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968 CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): qemu-2.11.2-5.29.1 SUSE OpenStack Cloud 9 (src): qemu-2.11.2-5.29.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): qemu-2.11.2-5.29.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): qemu-2.11.2-5.29.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1244-1: An update that solves 24 vulnerabilities and has four fixes is now available. Category: security (important) Bug References: 1129962,1154790,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178565,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968 CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): qemu-2.11.2-9.43.1 SUSE Linux Enterprise Server 15-LTSS (src): qemu-2.11.2-9.43.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): qemu-2.11.2-9.43.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): qemu-2.11.2-9.43.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1242-1: An update that solves 21 vulnerabilities and has 5 fixes is now available. Category: security (important) Bug References: 1172383,1172385,1172386,1172478,1173612,1176673,1176682,1176684,1178049,1178174,1178934,1179466,1179467,1179468,1179686,1179725,1179726,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968,1183979 CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-15469,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP5 (src): qemu-3.1.1.1-48.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:14704-1: An update that fixes 15 vulnerabilities is now available. Category: security (important) Bug References: 1172383,1172384,1172385,1172478,1175441,1176673,1176682,1176684,1178934,1179467,1181108,1182137,1182425,1182577 CVE References: CVE-2014-3689,CVE-2015-1779,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13765,CVE-2020-14364,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20257 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): kvm-1.4.2-60.34.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1305-1: An update that solves 21 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179467,1180523,1181108,1181639,1182137,1182425,1182577,1182968 CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP2-LTSS-SAP (src): qemu-2.6.2-41.62.1 SUSE Linux Enterprise Server 12-SP2-LTSS-ERICSSON (src): qemu-2.6.2-41.62.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): qemu-2.6.2-41.62.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:0600-1: An update that solves 15 vulnerabilities and has two fixes is now available. Category: security (important) Bug References: 1172385,1173612,1176673,1176682,1176684,1178174,1178400,1178934,1179466,1179467,1179468,1179686,1181108,1182425,1182577,1182968,1184064 CVE References: CVE-2020-12829,CVE-2020-15469,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27616,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: openSUSE Leap 15.2 (src): qemu-4.2.1-lp152.9.12.1, qemu-linux-user-4.2.1-lp152.9.12.1, qemu-testsuite-4.2.1-lp152.9.12.1
SUSE-SU-2021:14706-1: An update that fixes 21 vulnerabilities is now available. Category: security (important) Bug References: 1123156,1146873,1149811,1161066,1163018,1170940,1172383,1172384,1172385,1172478,1175441,1176673,1176682,1176684,1178934,1179467,1181108,1182137,1182425,1182577 CVE References: CVE-2014-3689,CVE-2015-1779,CVE-2019-12068,CVE-2019-15890,CVE-2019-6778,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13765,CVE-2020-14364,CVE-2020-1983,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-29130,CVE-2020-29443,CVE-2020-7039,CVE-2020-8608,CVE-2021-20181,CVE-2021-20257 JIRA References: Sources used: SUSE Linux Enterprise Point of Sale 11-SP3 (src): kvm-1.4.2-53.38.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
done