Bugzilla – Bug 1182577
VUL-0: CVE-2021-20257: kvm,qemu: infinite loop issue in the e1000 NIC emulator
Last modified: 2023-08-04 11:21:46 UTC
CVE-2021-20257 / rh#1930087 An infinite loop issue was found in the e1000 NIC emulator of the QEMU. It occurs while processing transmit (tx) descriptors in process_tx_desc, if various descriptor fields are initialised with invalid values. A guest may use this flaw to consume cpu cycles on the host resulting in DoS scenario. Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg03595.html References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20257 https://access.redhat.com/security/cve/CVE-2021-20257
Affected packages are: * SUSE:SLE-11-SP1:Update/kvm * SUSE:SLE-11-SP3:Update/kvm * SUSE:SLE-11-SP4:Update/kvm * SUSE:SLE-11-SP1:Update:Teradata/xen * SUSE:SLE-11-SP3:Update:Teradata/xen * SUSE:SLE-11-SP3:Update/xen * SUSE:SLE-11-SP4:Update/xen * SUSE:SLE-12-SP2:Update/xen * SUSE:SLE-12-SP3:Update/xen * SUSE:SLE-12-SP4:Update/xen * SUSE:SLE-12-SP5:Update/xen * SUSE:SLE-11:Update/qemu * SUSE:SLE-12-SP2:Update/qemu * SUSE:SLE-12-SP3:Update/qemu * SUSE:SLE-12-SP4:Update/qemu * SUSE:SLE-12-SP5:Update/qemu * SUSE:SLE-15:Update/qemu * SUSE:SLE-15-SP1:Update/qemu * SUSE:SLE-15-SP2:Update/qemu * SUSE:SLE-15-SP3:Update/qemu
Created attachment 846607 [details] Upstream patch A newer upstream patch was released [0], please use this one. [0] https://www.openwall.com/lists/oss-security/2021/02/25/2
xen tracking at bsc#1182846
This is an autogenerated message for OBS integration: This bug (1182577) was mentioned in https://build.opensuse.org/request/show/879687 Factory / qemu
Not fixing in SLE-11 qemu or SLE-11-SP1 kvm. For other releases fix is included in maintenance request already submitted. Returning to security team.
SUSE-SU-2021:1243-1: An update that solves 15 vulnerabilities and has two fixes is now available. Category: security (important) Bug References: 1172385,1173612,1176673,1176682,1176684,1178174,1178400,1178934,1179466,1179467,1179468,1179686,1181108,1182425,1182577,1182968,1184064 CVE References: CVE-2020-12829,CVE-2020-15469,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27616,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: SUSE MicroOS 5.0 (src): qemu-4.2.1-11.16.3 SUSE Linux Enterprise Module for Server Applications 15-SP2 (src): qemu-4.2.1-11.16.3 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): qemu-4.2.1-11.16.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1245-1: An update that solves 25 vulnerabilities and has four fixes is now available. Category: security (important) Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178049,1178174,1178565,1178934,1179466,1179467,1179468,1179686,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968,1183979 CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: SUSE Manager Server 4.0 (src): qemu-3.1.1.1-9.24.3 SUSE Manager Retail Branch Server 4.0 (src): qemu-3.1.1.1-9.24.3 SUSE Manager Proxy 4.0 (src): qemu-3.1.1.1-9.24.3 SUSE Linux Enterprise Server for SAP 15-SP1 (src): qemu-3.1.1.1-9.24.3 SUSE Linux Enterprise Server 15-SP1-LTSS (src): qemu-3.1.1.1-9.24.3 SUSE Linux Enterprise Server 15-SP1-BCL (src): qemu-3.1.1.1-9.24.3 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): qemu-3.1.1.1-9.24.3 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): qemu-3.1.1.1-9.24.3 SUSE Enterprise Storage 6 (src): qemu-3.1.1.1-9.24.3 SUSE CaaS Platform 4.0 (src): qemu-3.1.1.1-9.24.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1240-1: An update that solves 22 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179467,1179468,1180523,1181108,1181639,1182137,1182425,1182577,1182968 CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 8 (src): qemu-2.9.1-6.47.1 SUSE OpenStack Cloud 8 (src): qemu-2.9.1-6.47.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): qemu-2.9.1-6.47.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): qemu-2.9.1-6.47.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): qemu-2.9.1-6.47.1 HPE Helion Openstack 8 (src): qemu-2.9.1-6.47.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1241-1: An update that solves 24 vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1112499,1119115,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968 CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): qemu-2.11.2-5.29.1 SUSE OpenStack Cloud 9 (src): qemu-2.11.2-5.29.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): qemu-2.11.2-5.29.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): qemu-2.11.2-5.29.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1244-1: An update that solves 24 vulnerabilities and has four fixes is now available. Category: security (important) Bug References: 1129962,1154790,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178565,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968 CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): qemu-2.11.2-9.43.1 SUSE Linux Enterprise Server 15-LTSS (src): qemu-2.11.2-9.43.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): qemu-2.11.2-9.43.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): qemu-2.11.2-9.43.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1242-1: An update that solves 21 vulnerabilities and has 5 fixes is now available. Category: security (important) Bug References: 1172383,1172385,1172386,1172478,1173612,1176673,1176682,1176684,1178049,1178174,1178934,1179466,1179467,1179468,1179686,1179725,1179726,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968,1183979 CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-15469,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP5 (src): qemu-3.1.1.1-48.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:14704-1: An update that fixes 15 vulnerabilities is now available. Category: security (important) Bug References: 1172383,1172384,1172385,1172478,1175441,1176673,1176682,1176684,1178934,1179467,1181108,1182137,1182425,1182577 CVE References: CVE-2014-3689,CVE-2015-1779,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13765,CVE-2020-14364,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20257 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): kvm-1.4.2-60.34.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:1305-1: An update that solves 21 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179467,1180523,1181108,1181639,1182137,1182425,1182577,1182968 CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP2-LTSS-SAP (src): qemu-2.6.2-41.62.1 SUSE Linux Enterprise Server 12-SP2-LTSS-ERICSSON (src): qemu-2.6.2-41.62.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): qemu-2.6.2-41.62.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:0600-1: An update that solves 15 vulnerabilities and has two fixes is now available. Category: security (important) Bug References: 1172385,1173612,1176673,1176682,1176684,1178174,1178400,1178934,1179466,1179467,1179468,1179686,1181108,1182425,1182577,1182968,1184064 CVE References: CVE-2020-12829,CVE-2020-15469,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27616,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20257,CVE-2021-3416 JIRA References: Sources used: openSUSE Leap 15.2 (src): qemu-4.2.1-lp152.9.12.1, qemu-linux-user-4.2.1-lp152.9.12.1, qemu-testsuite-4.2.1-lp152.9.12.1
SUSE-SU-2021:14706-1: An update that fixes 21 vulnerabilities is now available. Category: security (important) Bug References: 1123156,1146873,1149811,1161066,1163018,1170940,1172383,1172384,1172385,1172478,1175441,1176673,1176682,1176684,1178934,1179467,1181108,1182137,1182425,1182577 CVE References: CVE-2014-3689,CVE-2015-1779,CVE-2019-12068,CVE-2019-15890,CVE-2019-6778,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13765,CVE-2020-14364,CVE-2020-1983,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-29130,CVE-2020-29443,CVE-2020-7039,CVE-2020-8608,CVE-2021-20181,CVE-2021-20257 JIRA References: Sources used: SUSE Linux Enterprise Point of Sale 11-SP3 (src): kvm-1.4.2-53.38.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Done.