Bug 982959 - (CVE-2016-5238) VUL-0: CVE-2016-5238: qemu/kvm: scsi: esp: OOB write when using non-DMA mode in get_cmd
(CVE-2016-5238)
VUL-0: CVE-2016-5238: qemu/kvm: scsi: esp: OOB write when using non-DMA mode ...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Bruce Rogers
Security Team bot
https://smash.suse.de/issue/169694/
CVSSv2:SUSE:CVE-2016-5238:4.1:(AV:L/A...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2016-06-03 08:58 UTC by Marcus Meissner
Modified: 2017-05-11 01:11 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2016-06-03 08:58:09 UTC
CVE-2016-5238

    Quick Emulator(Qemu) built with the ESP/NCR53C9x controller emulation support
    is vulnerable to an OOB write access issue. The controller uses 16-byte FIFO
    buffer for command and information transfer. The OOB write occurs while
    reading from information transfer buffer via non-DMA mode in routine
    get_cmd().

    A privileged user inside guest could use this flaw to crash the Qemu process
    resulting in DoS.

    https://bugzilla.redhat.com/show_bug.cgi?id=1341931
    https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg00150.html


        Add check to validate command length against buffer size to avoid any
        overrun.


Use CVE-2016-5238.

The scope of this CVE is the missing "dmalen > TI_BUFSZ" check in
the get_cmd function. The scope of this CVE does not include the
"At least the following patch is needed to ensure that ti_size always
matches ti_rptr/ti_wptr" discussion.

This is not yet available at
http://git.qemu.org/?p=qemu.git;a=history;f=hw/scsi/esp.c but
that may be an expected place for a later update.


References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5238
http://seclists.org/oss-sec/2016/q2/455
Comment 1 Swamp Workflow Management 2016-06-03 22:00:13 UTC
bugbot adjusting priority
Comment 2 Johannes Segitz 2016-07-22 11:34:01 UTC
Upstream fix: https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg00150.html
Comment 4 Swamp Workflow Management 2016-10-21 17:10:31 UTC
SUSE-SU-2016:2589-1: An update that solves 19 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1000048,967012,967013,982017,982018,982019,982222,982223,982285,982959,983961,983982,991080,991466,994760,994771,994774,996441,997858,997859
CVE References: CVE-2016-2391,CVE-2016-2392,CVE-2016-4453,CVE-2016-4454,CVE-2016-5105,CVE-2016-5106,CVE-2016-5107,CVE-2016-5126,CVE-2016-5238,CVE-2016-5337,CVE-2016-5338,CVE-2016-5403,CVE-2016-6490,CVE-2016-6833,CVE-2016-6836,CVE-2016-6888,CVE-2016-7116,CVE-2016-7155,CVE-2016-7156
Sources used:
SUSE Linux Enterprise Server 12-SP1 (src):    qemu-2.3.1-21.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    qemu-2.3.1-21.1
Comment 5 Swamp Workflow Management 2016-10-25 18:14:53 UTC
SUSE-SU-2016:2628-1: An update that fixes 16 vulnerabilities is now available.

Category: security (moderate)
Bug References: 902737,944697,967012,967013,982017,982018,982019,982222,982223,982285,982959,983961,983982,991080,991466,996441
CVE References: CVE-2014-7815,CVE-2015-6815,CVE-2016-2391,CVE-2016-2392,CVE-2016-4453,CVE-2016-4454,CVE-2016-5105,CVE-2016-5106,CVE-2016-5107,CVE-2016-5126,CVE-2016-5238,CVE-2016-5337,CVE-2016-5338,CVE-2016-5403,CVE-2016-6490,CVE-2016-7116
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    kvm-1.4.2-47.1
Comment 6 Swamp Workflow Management 2016-10-26 12:13:21 UTC
openSUSE-SU-2016:2642-1: An update that solves 19 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1000048,967012,967013,982017,982018,982019,982222,982223,982285,982959,983961,983982,991080,991466,994760,994771,994774,996441,997858,997859
CVE References: CVE-2016-2391,CVE-2016-2392,CVE-2016-4453,CVE-2016-4454,CVE-2016-5105,CVE-2016-5106,CVE-2016-5107,CVE-2016-5126,CVE-2016-5238,CVE-2016-5337,CVE-2016-5338,CVE-2016-5403,CVE-2016-6490,CVE-2016-6833,CVE-2016-6836,CVE-2016-6888,CVE-2016-7116,CVE-2016-7155,CVE-2016-7156
Sources used:
openSUSE Leap 42.1 (src):    qemu-2.3.1-19.3, qemu-linux-user-2.3.1-19.1, qemu-testsuite-2.3.1-19.6
Comment 7 Swamp Workflow Management 2016-11-12 07:09:15 UTC
SUSE-SU-2016:2781-1: An update that fixes 21 vulnerabilities is now available.

Category: security (moderate)
Bug References: 893323,944697,967012,967013,982017,982018,982019,982222,982223,982285,982959,983961,983982,991080,991466,994760,994771,994774,996441,997858,997859
CVE References: CVE-2014-5388,CVE-2015-6815,CVE-2016-2391,CVE-2016-2392,CVE-2016-4453,CVE-2016-4454,CVE-2016-5105,CVE-2016-5106,CVE-2016-5107,CVE-2016-5126,CVE-2016-5238,CVE-2016-5337,CVE-2016-5338,CVE-2016-5403,CVE-2016-6490,CVE-2016-6833,CVE-2016-6836,CVE-2016-6888,CVE-2016-7116,CVE-2016-7155,CVE-2016-7156
Sources used:
SUSE Linux Enterprise Server for SAP 12 (src):    qemu-2.0.2-48.22.1
SUSE Linux Enterprise Server 12-LTSS (src):    qemu-2.0.2-48.22.1
Comment 8 Bruce Rogers 2017-03-08 16:51:51 UTC
Fixed.