Bug 1174641 (CVE-2020-16092) - VUL-1: CVE-2020-16092: kvm,qemu: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c
Summary: VUL-1: CVE-2020-16092: kvm,qemu: reachable assertion failure in net_tx_pkt_ad...
Status: RESOLVED FIXED
Alias: CVE-2020-16092
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/264445/
Whiteboard: CVSSv3.1:SUSE:CVE-2020-16092:3.8:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2020-07-29 08:31 UTC by Wolfgang Frisch
Modified: 2022-09-16 12:18 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Wolfgang Frisch 2020-07-29 08:31:59 UTC
CVE-2020-16092

An assertion failure issue was found in the net_tx_pkt_add_raw_fragment() function in hw/net/net_tx_pkt.c. This assertion comes from the code that processes network packets. This code is shared between e1000e, vmxnet3 and apparently a few more devices. A malicious guest user/process could abuse this flaw to abort the QEMU process on the host, resulting in a denial of service condition.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1860283
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16092
Comment 2 Wolfgang Frisch 2020-08-13 14:59:02 UTC
SUSE:SLE-11:Update       qemu      Not affected [1]
SUSE:SLE-11:Update       kvm       Not affected [1]
SUSE:SLE-11-SP1:Update   kvm       Not affected [1]
SUSE:SLE-11-SP3:Update   kvm       Not affected [1]
SUSE:SLE-11-SP4:Update   kvm       Not affected [1]
SUSE:SLE-12-SP2:Update   qemu      Affected [2]
SUSE:SLE-12-SP3:Update   qemu      Affected
SUSE:SLE-12-SP4:Update   qemu      Affected
SUSE:SLE-12-SP5:Update   qemu      Affected
SUSE:SLE-15:Update       qemu      Affected
SUSE:SLE-15-SP1:Update   qemu      Affected
SUSE:SLE-15-SP2:Update   qemu      Affected

[1] code does not exist
[2] similar code is present in
    hw/net/vmxnet_tx_pkt.c, which appears to be the precursor for
    hw/net/net_tx_pkt.c, found in later versions.
Comment 5 Swamp Workflow Management 2020-09-24 19:16:52 UTC
SUSE-SU-2020:2743-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1172384,1174386,1174641,1175441
CVE References: CVE-2020-13361,CVE-2020-14364,CVE-2020-15863,CVE-2020-16092
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    qemu-3.1.1.1-45.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Swamp Workflow Management 2020-10-07 16:16:57 UTC
SUSE-SU-2020:2877-1: An update that solves four vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1174386,1174641,1174863,1175370,1175441,1176494
CVE References: CVE-2020-14364,CVE-2020-15863,CVE-2020-16092,CVE-2020-24352
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP2 (src):    qemu-4.2.1-11.10.1
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    qemu-4.2.1-11.10.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Swamp Workflow Management 2020-10-13 04:14:35 UTC
openSUSE-SU-2020:1664-1: An update that solves four vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1174386,1174641,1174863,1175370,1175441,1176494
CVE References: CVE-2020-14364,CVE-2020-15863,CVE-2020-16092,CVE-2020-24352
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    qemu-4.2.1-lp152.9.6.1, qemu-linux-user-4.2.1-lp152.9.6.1, qemu-testsuite-4.2.1-lp152.9.6.1
Comment 8 OBSbugzilla Bot 2020-12-08 23:50:15 UTC
This is an autogenerated message for OBS integration:
This bug (1174641) was mentioned in
https://build.opensuse.org/request/show/854157 Factory / qemu
Comment 12 Bruce Rogers 2021-04-07 01:32:06 UTC
Fix submitted in maintenance request for all affected qemu releases. Returning to security team.
Comment 13 Swamp Workflow Management 2021-04-16 16:19:00 UTC
SUSE-SU-2021:1245-1: An update that solves 25 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178049,1178174,1178565,1178934,1179466,1179467,1179468,1179686,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968,1183979
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Manager Server 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Manager Retail Branch Server 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Manager Proxy 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server 15-SP1-BCL (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    qemu-3.1.1.1-9.24.3
SUSE Enterprise Storage 6 (src):    qemu-3.1.1.1-9.24.3
SUSE CaaS Platform 4.0 (src):    qemu-3.1.1.1-9.24.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2021-04-16 16:22:39 UTC
SUSE-SU-2021:1240-1: An update that solves 22 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179467,1179468,1180523,1181108,1181639,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    qemu-2.9.1-6.47.1
SUSE OpenStack Cloud 8 (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    qemu-2.9.1-6.47.1
HPE Helion Openstack 8 (src):    qemu-2.9.1-6.47.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Swamp Workflow Management 2021-04-16 16:25:53 UTC
SUSE-SU-2021:1241-1: An update that solves 24 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1112499,1119115,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    qemu-2.11.2-5.29.1
SUSE OpenStack Cloud 9 (src):    qemu-2.11.2-5.29.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    qemu-2.11.2-5.29.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    qemu-2.11.2-5.29.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 Swamp Workflow Management 2021-04-16 16:29:23 UTC
SUSE-SU-2021:1244-1: An update that solves 24 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1129962,1154790,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178565,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise Server 15-LTSS (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    qemu-2.11.2-9.43.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 17 Swamp Workflow Management 2021-04-22 19:16:22 UTC
SUSE-SU-2021:1305-1: An update that solves 21 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179467,1180523,1181108,1181639,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP2-LTSS-SAP (src):    qemu-2.6.2-41.62.1
SUSE Linux Enterprise Server 12-SP2-LTSS-ERICSSON (src):    qemu-2.6.2-41.62.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    qemu-2.6.2-41.62.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 19 Carlos López 2022-09-16 12:18:46 UTC
Done, closing.