Bug 1182137 - (CVE-2021-20181) VUL-0: CVE-2021-20181: qemu,kvm,: race condition in 9pfs may lead to privilege escalation
(CVE-2021-20181)
VUL-0: CVE-2021-20181: qemu,kvm,: race condition in 9pfs may lead to privile...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/277538/
CVSSv3.1:SUSE:CVE-2021-20181:7.5:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2021-02-11 15:51 UTC by Alexandros Toptsoglou
Modified: 2022-06-10 09:52 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandros Toptsoglou 2021-02-11 15:51:15 UTC
CVE-2021-20181

A flaw was found in QEMU in the way it handles a list of open file descriptors. Improper synchronization of this list can lead to a use-after-free.

Reference:
https://bugs.launchpad.net/qemu/+bug/1911666

Upstream patch:
https://git.qemu.org/?p=qemu.git;a=commit;h=89fbea8737e8f7b954745a1ffc4238d377055305

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1927007
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20181
https://access.redhat.com/security/cve/CVE-2021-20181
Comment 1 Alexandros Toptsoglou 2021-02-11 15:54:42 UTC
Tracked as affected 

kvm:

SLE11-SP3 
SLE11-SP4 

qemu: 

SLE12-SP2,SP3,SP4,SP5 
SLE15, SLE15-SP1,SP2 

This fix [1] is not yet in any stable release thus also Factory is affected. 

[1] https://github.com/qemu/qemu/commit/89fbea8737e8f7b954745a1ffc4238d377055305
Comment 3 Swamp Workflow Management 2021-02-19 14:16:59 UTC
SUSE-SU-2021:0521-1: An update that solves four vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1178049,1178565,1179717,1179719,1180523,1181639,1181933,1182137
CVE References: CVE-2020-11947,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP2 (src):    qemu-4.2.1-11.13.1
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    qemu-4.2.1-11.13.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 4 Swamp Workflow Management 2021-03-01 11:18:10 UTC
openSUSE-SU-2021:0363-1: An update that solves four vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1178049,1178565,1179717,1179719,1180523,1181639,1181933,1182137
CVE References: CVE-2020-11947,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    qemu-4.2.1-lp152.9.9.2, qemu-linux-user-4.2.1-lp152.9.9.3, qemu-testsuite-4.2.1-lp152.9.9.5
Comment 5 OBSbugzilla Bot 2021-03-17 14:10:18 UTC
This is an autogenerated message for OBS integration:
This bug (1182137) was mentioned in
https://build.opensuse.org/request/show/879687 Factory / qemu
Comment 9 Bruce Rogers 2021-04-07 02:17:40 UTC
Fix included in maintenance requests for affected releases. Returning to security team.
Comment 10 Swamp Workflow Management 2021-04-16 16:20:29 UTC
SUSE-SU-2021:1245-1: An update that solves 25 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178049,1178174,1178565,1178934,1179466,1179467,1179468,1179686,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968,1183979
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Manager Server 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Manager Retail Branch Server 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Manager Proxy 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server 15-SP1-BCL (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    qemu-3.1.1.1-9.24.3
SUSE Enterprise Storage 6 (src):    qemu-3.1.1.1-9.24.3
SUSE CaaS Platform 4.0 (src):    qemu-3.1.1.1-9.24.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2021-04-16 16:23:37 UTC
SUSE-SU-2021:1240-1: An update that solves 22 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179467,1179468,1180523,1181108,1181639,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    qemu-2.9.1-6.47.1
SUSE OpenStack Cloud 8 (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    qemu-2.9.1-6.47.1
HPE Helion Openstack 8 (src):    qemu-2.9.1-6.47.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2021-04-16 16:27:04 UTC
SUSE-SU-2021:1241-1: An update that solves 24 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1112499,1119115,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    qemu-2.11.2-5.29.1
SUSE OpenStack Cloud 9 (src):    qemu-2.11.2-5.29.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    qemu-2.11.2-5.29.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    qemu-2.11.2-5.29.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2021-04-16 16:30:38 UTC
SUSE-SU-2021:1244-1: An update that solves 24 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1129962,1154790,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178565,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise Server 15-LTSS (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    qemu-2.11.2-9.43.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2021-04-16 16:37:22 UTC
SUSE-SU-2021:1242-1: An update that solves 21 vulnerabilities and has 5 fixes is now available.

Category: security (important)
Bug References: 1172383,1172385,1172386,1172478,1173612,1176673,1176682,1176684,1178049,1178174,1178934,1179466,1179467,1179468,1179686,1179725,1179726,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968,1183979
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-15469,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    qemu-3.1.1.1-48.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Swamp Workflow Management 2021-04-20 16:18:02 UTC
SUSE-SU-2021:14704-1: An update that fixes 15 vulnerabilities is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172478,1175441,1176673,1176682,1176684,1178934,1179467,1181108,1182137,1182425,1182577
CVE References: CVE-2014-3689,CVE-2015-1779,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13765,CVE-2020-14364,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20257
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    kvm-1.4.2-60.34.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 Swamp Workflow Management 2021-04-22 19:17:15 UTC
SUSE-SU-2021:1305-1: An update that solves 21 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179467,1180523,1181108,1181639,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP2-LTSS-SAP (src):    qemu-2.6.2-41.62.1
SUSE Linux Enterprise Server 12-SP2-LTSS-ERICSSON (src):    qemu-2.6.2-41.62.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    qemu-2.6.2-41.62.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 17 Swamp Workflow Management 2021-04-23 19:19:06 UTC
SUSE-SU-2021:14706-1: An update that fixes 21 vulnerabilities is now available.

Category: security (important)
Bug References: 1123156,1146873,1149811,1161066,1163018,1170940,1172383,1172384,1172385,1172478,1175441,1176673,1176682,1176684,1178934,1179467,1181108,1182137,1182425,1182577
CVE References: CVE-2014-3689,CVE-2015-1779,CVE-2019-12068,CVE-2019-15890,CVE-2019-6778,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13765,CVE-2020-14364,CVE-2020-1983,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-29130,CVE-2020-29443,CVE-2020-7039,CVE-2020-8608,CVE-2021-20181,CVE-2021-20257
JIRA References: 
Sources used:
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    kvm-1.4.2-53.38.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 19 Carlos López 2022-06-10 09:52:55 UTC
Done, closing.