Bug 1007495 - (CVE-2016-9106) VUL-0: CVE-2016-9106: qemu: 9pfs: memory leakage in v9fs_write
(CVE-2016-9106)
VUL-0: CVE-2016-9106: qemu: 9pfs: memory leakage in v9fs_write
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: unspecified
Assigned To: Bruce Rogers
Security Team bot
CVSSv2:RedHat:CVE-2016-9106:2.3:(AV:A...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2016-10-28 11:47 UTC by Mikhail Kasimov
Modified: 2017-06-08 09:28 UTC (History)
6 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mikhail Kasimov 2016-10-28 11:47:44 UTC
Reference: http://seclists.org/oss-sec/2016/q4/272
==================================================
  Hello,

Quick Emulator(Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to a memory leakage issue. It could occur when calling v9fs_write call.


A privileged user inside guest could use this flaw to leak the host memory bytes resulting in DoS for other services.


Upstream patches:
-----------------
  -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02623.html

Reference:
----------
  -> http://wiki.qemu.org/Documentation/9psetup

This issue was reported by Li Qiang of 360.cn Inc.

Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

==================================================
Comment 1 Swamp Workflow Management 2016-10-28 22:01:54 UTC
bugbot adjusting priority
Comment 2 Alexander Bergmann 2016-10-31 11:16:33 UTC
CVE-2016-9106 was assigned to this issue.
Comment 3 Swamp Workflow Management 2016-11-22 18:09:30 UTC
SUSE-SU-2016:2879-1: An update that solves 21 vulnerabilities and has 6 fixes is now available.

Category: security (moderate)
Bug References: 1000345,1000346,1001151,1002116,1002549,1002550,1002557,1003612,1003613,1003878,1003893,1003894,1004702,1004706,1004707,1005353,1005374,1006536,1006538,1007263,1007391,1007493,1007494,1007495,1007769,1008148,998516
CVE References: CVE-2016-7161,CVE-2016-7170,CVE-2016-7422,CVE-2016-7466,CVE-2016-7907,CVE-2016-7908,CVE-2016-7909,CVE-2016-7994,CVE-2016-7995,CVE-2016-8576,CVE-2016-8577,CVE-2016-8578,CVE-2016-8667,CVE-2016-8668,CVE-2016-8669,CVE-2016-8909,CVE-2016-8910,CVE-2016-9101,CVE-2016-9104,CVE-2016-9105,CVE-2016-9106
Sources used:
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    qemu-2.6.2-31.2
SUSE Linux Enterprise Server 12-SP2 (src):    qemu-2.6.2-31.2
SUSE Linux Enterprise Desktop 12-SP2 (src):    qemu-2.6.2-31.2
Comment 4 Swamp Workflow Management 2016-11-24 17:13:37 UTC
SUSE-SU-2016:2902-1: An update that fixes 17 vulnerabilities is now available.

Category: security (important)
Bug References: 1001151,1002550,1002557,1003878,1003893,1003894,1004702,1004707,1006536,1006538,1007391,1007450,1007454,1007493,1007494,1007495,998516
CVE References: CVE-2016-7161,CVE-2016-7170,CVE-2016-7908,CVE-2016-7909,CVE-2016-8576,CVE-2016-8577,CVE-2016-8578,CVE-2016-8667,CVE-2016-8669,CVE-2016-8909,CVE-2016-8910,CVE-2016-9101,CVE-2016-9102,CVE-2016-9103,CVE-2016-9104,CVE-2016-9105,CVE-2016-9106
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    kvm-1.4.2-50.1
Comment 5 Swamp Workflow Management 2016-11-29 13:09:57 UTC
SUSE-SU-2016:2936-1: An update that solves 18 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1001151,1002116,1002550,1002557,1003878,1003893,1003894,1004702,1004707,1006536,1006538,1007391,1007450,1007454,1007493,1007494,1007495,998516,999661
CVE References: CVE-2016-7161,CVE-2016-7170,CVE-2016-7421,CVE-2016-7908,CVE-2016-7909,CVE-2016-8576,CVE-2016-8577,CVE-2016-8578,CVE-2016-8667,CVE-2016-8669,CVE-2016-8909,CVE-2016-8910,CVE-2016-9101,CVE-2016-9102,CVE-2016-9103,CVE-2016-9104,CVE-2016-9105,CVE-2016-9106
Sources used:
SUSE Linux Enterprise Server for SAP 12 (src):    qemu-2.0.2-48.25.1
SUSE Linux Enterprise Server 12-LTSS (src):    qemu-2.0.2-48.25.1
Comment 6 Swamp Workflow Management 2016-12-02 20:09:33 UTC
SUSE-SU-2016:2988-1: An update that solves 19 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1000345,1001151,1002116,1002550,1002557,1003878,1003893,1003894,1004702,1004707,1006536,1006538,1007391,1007450,1007454,1007493,1007494,1007495,996524,998516,999661
CVE References: CVE-2016-7161,CVE-2016-7170,CVE-2016-7421,CVE-2016-7466,CVE-2016-7908,CVE-2016-7909,CVE-2016-8576,CVE-2016-8577,CVE-2016-8578,CVE-2016-8667,CVE-2016-8669,CVE-2016-8909,CVE-2016-8910,CVE-2016-9101,CVE-2016-9102,CVE-2016-9103,CVE-2016-9104,CVE-2016-9105,CVE-2016-9106
Sources used:
SUSE Linux Enterprise Server 12-SP1 (src):    qemu-2.3.1-24.6
SUSE Linux Enterprise Desktop 12-SP1 (src):    qemu-2.3.1-24.6
Comment 7 Matthias Gerstner 2016-12-07 15:58:32 UTC
Analysis shows the following affected codestreams for qemu/kvm:

kvm:

SUSE:SLE-11-SP3:Update/kvm/qemu-1.4.2/hw/9pfs/virtio-9p.c:1999
SUSE:SLE-11-SP4:Update/kvm/qemu-1.4.2/hw/9pfs/virtio-9p.c:1999

not affected:

kvm:

SUSE:SLE-11-SP2:Update/kvm/qemu-kvm-0.15.1/hw/9pfs/virtio-9p.c:3652 (different iov implementation)
SUSE:SLE-11-SP1:Update/kvm/qemu-kvm-0.12.5 (not contained)

already fixed:

qemu:

SUSE:SLE-12:Update/qemu/qemu-2.0.2/hw/9pfs/virtio-9p.c:2021
SUSE:SLE-12-SP1:Update/qemu/qemu-2.3.1/hw/9pfs/virtio-9p.c
SUSE:SLE-12-SP2:Update/qemu/qemu-2.6.2/hw/9pfs/9p.c:2065
Comment 8 Swamp Workflow Management 2016-12-12 18:21:35 UTC
openSUSE-SU-2016:3103-1: An update that solves 19 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1000345,1001151,1002116,1002550,1002557,1003878,1003893,1003894,1004702,1004707,1006536,1006538,1007391,1007450,1007454,1007493,1007494,1007495,996524,998516,999661
CVE References: CVE-2016-7161,CVE-2016-7170,CVE-2016-7421,CVE-2016-7466,CVE-2016-7908,CVE-2016-7909,CVE-2016-8576,CVE-2016-8577,CVE-2016-8578,CVE-2016-8667,CVE-2016-8669,CVE-2016-8909,CVE-2016-8910,CVE-2016-9101,CVE-2016-9102,CVE-2016-9103,CVE-2016-9104,CVE-2016-9105,CVE-2016-9106
Sources used:
openSUSE Leap 42.1 (src):    qemu-2.3.1-22.1, qemu-linux-user-2.3.1-22.1, qemu-testsuite-2.3.1-22.2
Comment 9 Andreas Osterburg 2016-12-15 16:25:34 UTC
Since SLES12-SP2 is affected, I think Leap 42.2 is affected, too.
Will there be an update available?
Comment 10 Bruce Rogers 2016-12-15 17:14:55 UTC
(In reply to Andreas Osterburg from comment #9)
> Since SLES12-SP2 is affected, I think Leap 42.2 is affected, too.
> Will there be an update available?

I'm working on getting Leap 42.2 back to a synchronized state wrt qemu package - so yes, it will be available soon I hope.
Comment 11 Swamp Workflow Management 2016-12-22 14:15:18 UTC
openSUSE-SU-2016:3237-1: An update that solves 21 vulnerabilities and has 5 fixes is now available.

Category: security (moderate)
Bug References: 1000345,1000346,1001151,1002116,1002549,1002550,1002557,1003612,1003613,1003878,1003893,1003894,1004702,1004706,1004707,1005353,1005374,1006536,1006538,1007391,1007493,1007494,1007495,1007769,1008148,998516
CVE References: CVE-2016-7161,CVE-2016-7170,CVE-2016-7422,CVE-2016-7466,CVE-2016-7907,CVE-2016-7908,CVE-2016-7909,CVE-2016-7994,CVE-2016-7995,CVE-2016-8576,CVE-2016-8577,CVE-2016-8578,CVE-2016-8667,CVE-2016-8668,CVE-2016-8669,CVE-2016-8909,CVE-2016-8910,CVE-2016-9101,CVE-2016-9104,CVE-2016-9105,CVE-2016-9106
Sources used:
openSUSE Leap 42.2 (src):    qemu-2.6.2-23.1, qemu-linux-user-2.6.2-23.1, qemu-testsuite-2.6.2-23.1
Comment 12 Bruce Rogers 2017-03-08 16:34:50 UTC
Fixed.