Bugzilla – Bug 1135902
VUL-1: CVE-2019-12155: kvm,qemu: null pointer dereference while releasing spice resources
Last modified: 2021-05-27 12:47:46 UTC
CVE-2019-12155 A null pointer dereference issue was found the QXL VGA card emulator of QEMU. It could occur while releasing resources allocated for a SPICE server thread in interface_release_resources(). A guest user could use this flaw to crash the QEMU process resulting in DoS scenario. Upstream patch: --------------- -> https://git.qemu.org/?p=qemu.git;a=commit;h=d52680fc932efb8a2f334cc6993e705ed1e31e99 Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/05/22/1 References: https://bugzilla.redhat.com/show_bug.cgi?id=1712670 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12155 http://seclists.org/oss-sec/2019/q2/122 https://git.qemu.org/?p=qemu.git;a=commit;h=d52680fc932efb8a2f334cc6993e705ed1e31e99
For kvm: SLE11-SP1 --> Not affected SLE11-SP3 --> affected SLE11-SP4 (LTSS) --> affected For qemu: SLE11 --> Not affected SLE12,SLE12-SP1,2,3,4 --> affected SLE15 --> affected
Backport have been merged into our SLE11 SP3-SP4 SLE12 GA-SP4 SLE15 GA-SP1 Virt
SUSE-SU-2019:2192-1: An update that solves four vulnerabilities and has 7 fixes is now available. Category: security (important) Bug References: 1128106,1133031,1134883,1135210,1135902,1136540,1136778,1138534,1140402,1143794,1144087 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378,CVE-2019-5008 Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP1 (src): qemu-3.1.1-9.3.3 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): qemu-3.1.1-9.3.3, qemu-linux-user-3.1.1-9.3.2, qemu-testsuite-3.1.1-9.3.4 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): qemu-3.1.1-9.3.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:14151-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1135902,1140402,1143794 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378 Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): kvm-1.4.2-60.27.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2221-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1135902,1140402,1143794 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378 Sources used: SUSE Linux Enterprise Server for SAP 12-SP1 (src): qemu-2.3.1-33.26.1 SUSE Linux Enterprise Server 12-SP1-LTSS (src): qemu-2.3.1-33.26.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2246-1: An update that solves three vulnerabilities and has 7 fixes is now available. Category: security (important) Bug References: 1079730,1098403,1111025,1119115,1134883,1135902,1136540,1136778,1140402,1143794 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378 Sources used: SUSE Linux Enterprise Module for Server Applications 15 (src): qemu-2.11.2-9.28.3 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): qemu-2.11.2-9.28.3, qemu-linux-user-2.11.2-9.28.2 SUSE Linux Enterprise Module for Basesystem 15 (src): qemu-2.11.2-9.28.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:2041-1: An update that solves four vulnerabilities and has 7 fixes is now available. Category: security (important) Bug References: 1128106,1133031,1134883,1135210,1135902,1136540,1136778,1138534,1140402,1143794,1144087 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378,CVE-2019-5008 Sources used: openSUSE Leap 15.1 (src): qemu-3.1.1-lp151.7.3.3, qemu-linux-user-3.1.1-lp151.7.3.2, qemu-testsuite-3.1.1-lp151.7.3.3
openSUSE-SU-2019:2059-1: An update that solves three vulnerabilities and has 7 fixes is now available. Category: security (important) Bug References: 1079730,1098403,1111025,1119115,1134883,1135902,1136540,1136778,1140402,1143794 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378 Sources used: openSUSE Leap 15.0 (src): qemu-2.11.2-lp150.7.25.1
SUSE-SU-2019:2278-1: An update that solves three vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 1127077,1135902,1139926,1140402,1143794 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378 Sources used: SUSE CaaS Platform 3.0 (src): qemu-2.9.1-6.41.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2157-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1135902,1140402,1143794 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378 Sources used: SUSE OpenStack Cloud 7 (src): qemu-2.6.2-41.55.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): qemu-2.6.2-41.55.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): qemu-2.6.2-41.55.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): qemu-2.6.2-41.55.1 SUSE Enterprise Storage 4 (src): qemu-2.6.2-41.55.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2353-1: An update that solves three vulnerabilities and has 9 fixes is now available. Category: security (important) Bug References: 1079730,1098403,1111025,1127077,1134880,1135902,1136528,1136777,1139926,1140402,1141043,1143794 CVE References: CVE-2019-12155,CVE-2019-13164,CVE-2019-14378 Sources used: SUSE Linux Enterprise Server 12-SP4 (src): qemu-2.11.2-5.18.1 SUSE Linux Enterprise Desktop 12-SP4 (src): qemu-2.11.2-5.18.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Done