Bug 1172386 - (CVE-2020-13659) VUL-1: CVE-2020-13659: qemu: NULL pointer dereference in the MegaRAID SAS 8708EM2 emulator
(CVE-2020-13659)
VUL-1: CVE-2020-13659: qemu: NULL pointer dereference in the MegaRAID SAS 870...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/260306/
CVSSv3.1:SUSE:CVE-2020-13659:5.3:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-06-02 09:33 UTC by Wolfgang Frisch
Modified: 2021-08-26 16:16 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
CVE-2020-13659-qemu.patch (1.81 KB, patch)
2020-06-03 11:16 UTC, Wolfgang Frisch
Details | Diff
exec-set-map-length-to-zero-when-returning-NULL-CVE-2020-13659.patch (2.13 KB, patch)
2020-12-10 16:50 UTC, Wolfgang Frisch
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Wolfgang Frisch 2020-06-02 09:33:50 UTC
CVE-2020-13659

A NULL pointer dereference issue was found in the MegaRAID SAS 8708EM2 emulator of QEMU. This issue occurs because the address_space_map() API while mapping physical memory into host's virtual address space may return NULL, without setting the length parameter to zero(0). A guest user/process may use this flaw to crash the QEMU process on the host resulting in DoS scenario.

References:
https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg07313.html
https://www.openwall.com/lists/oss-security/2020/06/01/3
https://bugs.launchpad.net/qemu/+bug/1878259
https://bugzilla.redhat.com/show_bug.cgi?id=1842496
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13659
http://seclists.org/oss-sec/2020/q2/154
Comment 1 Wolfgang Frisch 2020-06-03 11:16:45 UTC
Created attachment 838457 [details]
CVE-2020-13659-qemu.patch

Upstream patch
Source: https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg07312.html
Comment 2 Bruce Rogers 2020-06-24 21:08:06 UTC
Patch is upstream as commit 77f55eac6c433e23e82a1b88b2d74f385c4c7d82.

Fix is queued for first maintenance update of SLE15-SP2.
Comment 5 Swamp Workflow Management 2020-07-23 10:22:10 UTC
SUSE-SU-2020:2015-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1172383,1172384,1172386,1172495,1172710
CVE References: CVE-2020-10761,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13800
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP2 (src):    qemu-4.2.1-11.4.4
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    qemu-4.2.1-11.4.4

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Swamp Workflow Management 2020-07-28 16:14:24 UTC
openSUSE-SU-2020:1108-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1172383,1172384,1172386,1172495,1172710
CVE References: CVE-2020-10761,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13800
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    qemu-4.2.1-lp152.9.3.1, qemu-linux-user-4.2.1-lp152.9.3.1, qemu-testsuite-4.2.1-lp152.9.3.1
Comment 7 Wolfgang Frisch 2020-12-10 16:49:55 UTC
SUSE:SLE-11:Update      qemu  Not affected [1]
SUSE:SLE-11-SP1:Update  kvm   Not affected [1]
SUSE:SLE-11-SP3:Update  kvm   Not affected [2]
SUSE:SLE-11-SP4:Update  kvm   Not affected [2]
SUSE:SLE-12-SP2:Update  qemu  Affected
SUSE:SLE-12-SP3:Update  qemu  Affected
SUSE:SLE-12-SP4:Update  qemu  Affected
SUSE:SLE-12-SP5:Update  qemu  Affected
SUSE:SLE-15:Update      qemu  Affected
SUSE:SLE-15-SP1:Update  qemu  Affected
SUSE:SLE-15-SP2:Update  qemu  Released
SUSE:SLE-15-SP3:Update  qemu  Already fixed

[1] does not support the MegaRAID SAS 8708EM2 emulator
[2] *plen in address_space_map() appears to be set correctly
Comment 8 Wolfgang Frisch 2020-12-10 16:50:52 UTC
Created attachment 844365 [details]
exec-set-map-length-to-zero-when-returning-NULL-CVE-2020-13659.patch
Comment 11 Bruce Rogers 2021-04-07 01:00:33 UTC
Fixed in maintenance requests submitted for all releases here identified as affected. Returning to security team.
Comment 12 Swamp Workflow Management 2021-04-16 16:18:40 UTC
SUSE-SU-2021:1245-1: An update that solves 25 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178049,1178174,1178565,1178934,1179466,1179467,1179468,1179686,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968,1183979
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Manager Server 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Manager Retail Branch Server 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Manager Proxy 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server 15-SP1-BCL (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    qemu-3.1.1.1-9.24.3
SUSE Enterprise Storage 6 (src):    qemu-3.1.1.1-9.24.3
SUSE CaaS Platform 4.0 (src):    qemu-3.1.1.1-9.24.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2021-04-16 16:22:19 UTC
SUSE-SU-2021:1240-1: An update that solves 22 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179467,1179468,1180523,1181108,1181639,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    qemu-2.9.1-6.47.1
SUSE OpenStack Cloud 8 (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    qemu-2.9.1-6.47.1
HPE Helion Openstack 8 (src):    qemu-2.9.1-6.47.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2021-04-16 16:25:33 UTC
SUSE-SU-2021:1241-1: An update that solves 24 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1112499,1119115,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    qemu-2.11.2-5.29.1
SUSE OpenStack Cloud 9 (src):    qemu-2.11.2-5.29.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    qemu-2.11.2-5.29.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    qemu-2.11.2-5.29.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Swamp Workflow Management 2021-04-16 16:29:03 UTC
SUSE-SU-2021:1244-1: An update that solves 24 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1129962,1154790,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178565,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise Server 15-LTSS (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    qemu-2.11.2-9.43.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 Swamp Workflow Management 2021-04-16 16:35:48 UTC
SUSE-SU-2021:1242-1: An update that solves 21 vulnerabilities and has 5 fixes is now available.

Category: security (important)
Bug References: 1172383,1172385,1172386,1172478,1173612,1176673,1176682,1176684,1178049,1178174,1178934,1179466,1179467,1179468,1179686,1179725,1179726,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968,1183979
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-15469,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    qemu-3.1.1.1-48.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 17 Swamp Workflow Management 2021-04-22 19:16:02 UTC
SUSE-SU-2021:1305-1: An update that solves 21 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179467,1180523,1181108,1181639,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP2-LTSS-SAP (src):    qemu-2.6.2-41.62.1
SUSE Linux Enterprise Server 12-SP2-LTSS-ERICSSON (src):    qemu-2.6.2-41.62.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    qemu-2.6.2-41.62.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 19 Marcus Meissner 2021-08-26 16:16:22 UTC
done