Bug 1181933 - (CVE-2021-20221) VUL-0: CVE-2021-20221: kvm,xen,qemu: out-of-bound heap buffer access via an interrupt ID field
(CVE-2021-20221)
VUL-0: CVE-2021-20221: kvm,xen,qemu: out-of-bound heap buffer access via an i...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/277035/
CVSSv3.1:SUSE:CVE-2021-20221:5.3:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-02-08 10:21 UTC by Alexander Bergmann
Modified: 2021-08-06 13:34 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---
jose.ziviani: needinfo? (abergmann)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2021-02-08 10:21:08 UTC
rh#1924601

An out-of-bound heap buffer access via an interrupt ID field resulting from undefined behaviour. The Interrupt ID of the SGI to forward to the specified CPU interfaces. The value of this field is the Interrupt ID, in the range 0-15, for example a value of 0b0011 specifies Interrupt ID 3.

It requires unusual kernel start-up with 'kernel-irqchip=off'.

This issue does not affect default configuration ie. kernel-irqchip=on.

Upstream patch:
---------------
  -> https://gitlab.com/qemu-project/qemu/-/commit/edfe2eb4360cde4ed5d95bda7777edcb3510f76a

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1924601
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20221
http://seclists.org/oss-sec/2021/q1/108
https://gitlab.com/qemu-project/qemu/-/commit/edfe2eb4360cde4ed5d95bda7777edcb3510f76a
Comment 1 OBSbugzilla Bot 2021-02-10 04:00:17 UTC
This is an autogenerated message for OBS integration:
This bug (1181933) was mentioned in
https://build.opensuse.org/request/show/870728 Factory / qemu
Comment 4 Swamp Workflow Management 2021-02-19 14:16:52 UTC
SUSE-SU-2021:0521-1: An update that solves four vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1178049,1178565,1179717,1179719,1180523,1181639,1181933,1182137
CVE References: CVE-2020-11947,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP2 (src):    qemu-4.2.1-11.13.1
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    qemu-4.2.1-11.13.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 5 Swamp Workflow Management 2021-03-01 11:18:04 UTC
openSUSE-SU-2021:0363-1: An update that solves four vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1178049,1178565,1179717,1179719,1180523,1181639,1181933,1182137
CVE References: CVE-2020-11947,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    qemu-4.2.1-lp152.9.9.2, qemu-linux-user-4.2.1-lp152.9.9.3, qemu-testsuite-4.2.1-lp152.9.9.5
Comment 7 Swamp Workflow Management 2021-04-16 16:20:24 UTC
SUSE-SU-2021:1245-1: An update that solves 25 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178049,1178174,1178565,1178934,1179466,1179467,1179468,1179686,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968,1183979
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Manager Server 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Manager Retail Branch Server 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Manager Proxy 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server 15-SP1-BCL (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    qemu-3.1.1.1-9.24.3
SUSE Enterprise Storage 6 (src):    qemu-3.1.1.1-9.24.3
SUSE CaaS Platform 4.0 (src):    qemu-3.1.1.1-9.24.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Swamp Workflow Management 2021-04-16 16:26:59 UTC
SUSE-SU-2021:1241-1: An update that solves 24 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1112499,1119115,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    qemu-2.11.2-5.29.1
SUSE OpenStack Cloud 9 (src):    qemu-2.11.2-5.29.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    qemu-2.11.2-5.29.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    qemu-2.11.2-5.29.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2021-04-16 16:30:34 UTC
SUSE-SU-2021:1244-1: An update that solves 24 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1129962,1154790,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178565,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise Server 15-LTSS (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    qemu-2.11.2-9.43.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2021-04-16 16:37:17 UTC
SUSE-SU-2021:1242-1: An update that solves 21 vulnerabilities and has 5 fixes is now available.

Category: security (important)
Bug References: 1172383,1172385,1172386,1172478,1173612,1176673,1176682,1176684,1178049,1178174,1178934,1179466,1179467,1179468,1179686,1179725,1179726,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968,1183979
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-15469,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    qemu-3.1.1.1-48.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Swamp Workflow Management 2021-06-02 16:17:50 UTC
SUSE-SU-2021:1829-1: An update that solves 11 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1031692,1094725,1126455,1149813,1163019,1172380,1172382,1175534,1178935,1179477,1181933,1182846,1182975
CVE References: CVE-2019-15890,CVE-2019-8934,CVE-2020-10756,CVE-2020-13754,CVE-2020-14364,CVE-2020-25723,CVE-2020-29130,CVE-2020-8608,CVE-2021-20221,CVE-2021-20257,CVE-2021-3419
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP2-BCL (src):    qemu-2.6.2-41.65.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 Swamp Workflow Management 2021-06-08 16:54:12 UTC
SUSE-SU-2021:1894-1: An update that solves 11 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1094725,1149813,1163019,1172380,1172382,1175534,1178683,1178935,1179477,1181933,1182846,1182975
CVE References: CVE-2019-15890,CVE-2020-10756,CVE-2020-13754,CVE-2020-14364,CVE-2020-25707,CVE-2020-25723,CVE-2020-29130,CVE-2020-8608,CVE-2021-20221,CVE-2021-20257,CVE-2021-3419
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    qemu-2.9.1-6.50.1
SUSE OpenStack Cloud 8 (src):    qemu-2.9.1-6.50.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    qemu-2.9.1-6.50.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    qemu-2.9.1-6.50.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    qemu-2.9.1-6.50.1
HPE Helion Openstack 8 (src):    qemu-2.9.1-6.50.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 17 José Ricardo Ziviani 2021-06-28 23:06:50 UTC
It seems to be fixed. Please, reopen it if we missed anything

Thank you
Comment 19 Swamp Workflow Management 2021-08-03 16:21:58 UTC
SUSE-SU-2021:14772-1: An update that fixes 8 vulnerabilities is now available.

Category: security (important)
Bug References: 1173612,1174386,1178683,1180523,1181933,1186473,1187364,1187367
CVE References: CVE-2020-11947,CVE-2020-15469,CVE-2020-15863,CVE-2020-25707,CVE-2021-20221,CVE-2021-3416,CVE-2021-3592,CVE-2021-3594
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    kvm-1.4.2-60.37.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 20 Swamp Workflow Management 2021-08-06 13:34:41 UTC
SUSE-SU-2021:14774-1: An update that solves 8 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1031692,1173612,1174386,1178683,1180523,1181933,1186473,1187364,1187367
CVE References: CVE-2020-11947,CVE-2020-15469,CVE-2020-15863,CVE-2020-25707,CVE-2021-20221,CVE-2021-3416,CVE-2021-3592,CVE-2021-3594
JIRA References: 
Sources used:
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    kvm-1.4.2-53.41.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.