Bug 1057585 - (CVE-2017-14167) VUL-0: CVE-2017-14167: kvm,qemu: i386: multiboot OOB access while loading kernel image
(CVE-2017-14167)
VUL-0: CVE-2017-14167: kvm,qemu: i386: multiboot OOB access while loading ker...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Minor
: ---
Assigned To: Fei Li
Security Team bot
https://smash.suse.de/issue/191548/
CVSSv2:SUSE:CVE-2017-14167:2.6:(AV:L/...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-09-07 11:46 UTC by Marcus Meissner
Modified: 2018-02-09 06:51 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2017-09-07 11:46:34 UTC
rh#1489375

Quick Emulator(Qemu) built with the PC System Emulator with multiboot feature
support is vulnerable to an OOB r/w memory access issue. It could occur due
to an integer overflow while loading a kernel image during a guest boot.

A user/process could use this flaw to potentially achieve arbitrary code
execution on a host.

Upstream patch:
---------------
  -> https://lists.nongnu.org/archive/html/qemu-devel/2017-09/msg01483.html
Comment 1 Marcus Meissner 2017-09-07 11:52:26 UTC
not in kvm.
in SLE12* qemus
not in xen.
Comment 2 Fei Li 2017-09-20 06:52:50 UTC
The upstream commit id is ed4f86e8b6eff8e600c69adee68c7cd34dd2cccb
Comment 3 Fei Li 2017-09-20 06:56:45 UTC
(In reply to Marcus Meissner from comment #1)
> not in kvm.
> in SLE12* qemus
> not in xen.

Hi Marcus,
I find the following code is already existed in sle11-sp3/4 (qemu version v1.4.2):
commit 9c3a596a03cc10c2d9097f057b9ccb9d557a4d5f
--- a/hw/multiboot.c
+++ b/hw/multiboot.c
@@ -202,10 +202,16 @@ int load_multiboot(void *fw_cfg,
         uint32_t mh_bss_end_addr = ldl_p(header+i+24);
         mh_load_addr = ldl_p(header+i+16);
         uint32_t mb_kernel_text_offset = i - (mh_header_addr - mh_load_addr);
-        uint32_t mb_load_size = mh_load_end_addr - mh_load_addr;
-
+        uint32_t mb_load_size = 0;
         mh_entry_addr = ldl_p(header+i+28);
-        mb_kernel_size = mh_bss_end_addr - mh_load_addr;
+
+        if (mh_load_end_addr) {
+            mb_kernel_size = mh_bss_end_addr - mh_load_addr;
+            mb_load_size = mh_load_end_addr - mh_load_addr;
+        } else {
+            mb_kernel_size = kernel_file_size - mb_kernel_text_offset;
+            mb_load_size = mb_kernel_size;
+        }

which means sle11-sp3/4 is also affected. Please correct me if I understand wrong, thanks.
Comment 4 Johannes Segitz 2017-09-20 08:46:05 UTC
Agreed, I set it to affected in our tracking tool
Comment 5 Bernhard Wiedemann 2017-10-06 00:01:11 UTC
This is an autogenerated message for OBS integration:
This bug (1057585) was mentioned in
https://build.opensuse.org/request/show/531956 Factory / qemu
Comment 6 Swamp Workflow Management 2017-11-02 23:09:07 UTC
SUSE-SU-2017:2924-1: An update that solves 8 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1054724,1055587,1056291,1056334,1057378,1057585,1057966,1062069,1062942,1063122
CVE References: CVE-2017-10911,CVE-2017-12809,CVE-2017-13672,CVE-2017-13711,CVE-2017-14167,CVE-2017-15038,CVE-2017-15268,CVE-2017-15289
Sources used:
SUSE Linux Enterprise Server 12-SP3 (src):    qemu-2.9.1-6.6.3
SUSE Linux Enterprise Desktop 12-SP3 (src):    qemu-2.9.1-6.6.3
Comment 7 Swamp Workflow Management 2017-11-06 20:09:20 UTC
SUSE-SU-2017:2936-1: An update that solves 12 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1043176,1043808,1046636,1047674,1048902,1049381,1054724,1056334,1057378,1057585,1057966,1059369,1062069,1062942,1063122,997358
CVE References: CVE-2017-10664,CVE-2017-10806,CVE-2017-10911,CVE-2017-11334,CVE-2017-11434,CVE-2017-12809,CVE-2017-13672,CVE-2017-14167,CVE-2017-15038,CVE-2017-15268,CVE-2017-15289,CVE-2017-9524
Sources used:
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    qemu-2.6.2-41.22.2
SUSE Linux Enterprise Server 12-SP2 (src):    qemu-2.6.2-41.22.2
SUSE Linux Enterprise Desktop 12-SP2 (src):    qemu-2.6.2-41.22.2
Comment 8 Swamp Workflow Management 2017-11-07 05:10:11 UTC
openSUSE-SU-2017:2938-1: An update that solves 8 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1054724,1055587,1056291,1056334,1057378,1057585,1057966,1062069,1062942,1063122
CVE References: CVE-2017-10911,CVE-2017-12809,CVE-2017-13672,CVE-2017-13711,CVE-2017-14167,CVE-2017-15038,CVE-2017-15268,CVE-2017-15289
Sources used:
openSUSE Leap 42.3 (src):    qemu-2.9.1-35.1, qemu-linux-user-2.9.1-35.1, qemu-testsuite-2.9.1-35.1
Comment 9 Swamp Workflow Management 2017-11-07 05:13:25 UTC
openSUSE-SU-2017:2941-1: An update that solves 12 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1043176,1043808,1046636,1047674,1048902,1049381,1054724,1056334,1057378,1057585,1057966,1059369,1062069,1062942,1063122,997358
CVE References: CVE-2017-10664,CVE-2017-10806,CVE-2017-10911,CVE-2017-11334,CVE-2017-11434,CVE-2017-12809,CVE-2017-13672,CVE-2017-14167,CVE-2017-15038,CVE-2017-15268,CVE-2017-15289,CVE-2017-9524
Sources used:
openSUSE Leap 42.2 (src):    qemu-2.6.2-31.9.1, qemu-linux-user-2.6.2-31.9.1, qemu-testsuite-2.6.2-31.9.2
Comment 10 Swamp Workflow Management 2017-11-08 11:14:28 UTC
SUSE-SU-2017:2946-1: An update that solves 33 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1020427,1021741,1025109,1025311,1028184,1028656,1030624,1032075,1034866,1034908,1035406,1035950,1036211,1037242,1037334,1037336,1039495,1042159,1042800,1042801,1043073,1043296,1045035,1046636,1047674,1048902,1049381,1054724,1056334,1057378,1057585,1062069,1063122,994418,994605
CVE References: CVE-2016-6834,CVE-2016-6835,CVE-2016-9602,CVE-2016-9603,CVE-2017-10664,CVE-2017-10806,CVE-2017-10911,CVE-2017-11334,CVE-2017-11434,CVE-2017-12809,CVE-2017-13672,CVE-2017-14167,CVE-2017-15038,CVE-2017-15289,CVE-2017-5579,CVE-2017-5973,CVE-2017-5987,CVE-2017-6505,CVE-2017-7377,CVE-2017-7471,CVE-2017-7493,CVE-2017-7718,CVE-2017-7980,CVE-2017-8086,CVE-2017-8112,CVE-2017-8309,CVE-2017-8379,CVE-2017-8380,CVE-2017-9330,CVE-2017-9373,CVE-2017-9374,CVE-2017-9375,CVE-2017-9503
Sources used:
SUSE OpenStack Cloud 6 (src):    qemu-2.3.1-33.3.3
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    qemu-2.3.1-33.3.3
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    qemu-2.3.1-33.3.3
Comment 11 Swamp Workflow Management 2017-11-10 08:09:37 UTC
SUSE-SU-2017:2963-1: An update that solves 23 vulnerabilities and has 6 fixes is now available.

Category: security (important)
Bug References: 1020427,1021741,1025109,1028184,1028656,1030624,1031051,1034044,1034866,1034908,1035406,1035950,1037242,1038396,1039495,1042159,1042800,1042801,1043296,1045035,1046636,1047674,1048902,1049381,1049785,1056334,1057585,1062069,1063122
CVE References: CVE-2016-9602,CVE-2016-9603,CVE-2017-10664,CVE-2017-10806,CVE-2017-11334,CVE-2017-11434,CVE-2017-13672,CVE-2017-14167,CVE-2017-15038,CVE-2017-15289,CVE-2017-5579,CVE-2017-5973,CVE-2017-6505,CVE-2017-7471,CVE-2017-7493,CVE-2017-7718,CVE-2017-7980,CVE-2017-8086,CVE-2017-8309,CVE-2017-9330,CVE-2017-9373,CVE-2017-9375,CVE-2017-9503
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    kvm-1.4.2-60.3.1
Comment 12 Swamp Workflow Management 2017-11-10 08:23:27 UTC
SUSE-SU-2017:2969-1: An update that solves 29 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1020427,1021741,1025109,1025311,1026612,1028184,1028656,1030624,1032075,1034866,1034908,1035406,1035950,1036211,1037242,1039495,1042159,1042800,1042801,1043296,1045035,1046636,1047674,1048902,1049381,1056334,1057585,1062069,1063122,994418,994605
CVE References: CVE-2016-6834,CVE-2016-6835,CVE-2016-9602,CVE-2016-9603,CVE-2017-10664,CVE-2017-10806,CVE-2017-11334,CVE-2017-11434,CVE-2017-13672,CVE-2017-14167,CVE-2017-15038,CVE-2017-15289,CVE-2017-2633,CVE-2017-5579,CVE-2017-5973,CVE-2017-5987,CVE-2017-6505,CVE-2017-7377,CVE-2017-7471,CVE-2017-7493,CVE-2017-7718,CVE-2017-7980,CVE-2017-8086,CVE-2017-8112,CVE-2017-8309,CVE-2017-9330,CVE-2017-9373,CVE-2017-9375,CVE-2017-9503
Sources used:
SUSE Linux Enterprise Server 12-LTSS (src):    qemu-2.0.2-48.34.3
Comment 13 Swamp Workflow Management 2017-11-24 20:17:35 UTC
SUSE-SU-2017:3084-1: An update that solves 33 vulnerabilities and has 7 fixes is now available.

Category: security (important)
Bug References: 1013285,1014109,1014111,1014702,1015048,1016779,1020427,1021129,1021741,1023004,1023053,1023907,1024972,1025109,1028184,1028656,1030624,1031051,1034044,1034866,1034908,1035406,1035950,1037242,1038396,1039495,1042159,1042800,1042801,1043296,1045035,1046636,1047674,1048902,1049381,1049785,1056334,1057585,1062069,1063122
CVE References: CVE-2016-10155,CVE-2016-9602,CVE-2016-9603,CVE-2016-9776,CVE-2016-9907,CVE-2016-9911,CVE-2016-9921,CVE-2016-9922,CVE-2017-10664,CVE-2017-10806,CVE-2017-11334,CVE-2017-11434,CVE-2017-13672,CVE-2017-14167,CVE-2017-15038,CVE-2017-15289,CVE-2017-2615,CVE-2017-2620,CVE-2017-5579,CVE-2017-5856,CVE-2017-5898,CVE-2017-5973,CVE-2017-6505,CVE-2017-7471,CVE-2017-7493,CVE-2017-7718,CVE-2017-7980,CVE-2017-8086,CVE-2017-8309,CVE-2017-9330,CVE-2017-9373,CVE-2017-9375,CVE-2017-9503
Sources used:
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    kvm-1.4.2-53.11.1
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    kvm-1.4.2-53.11.1
Comment 14 Marcus Meissner 2018-02-09 06:51:23 UTC
released