Bug 1174386 – VUL-0: CVE-2020-15863: kvm,qemu: stack-based overflow in xgmac_enet_send() in hw/net/xgmac.c

Bug 1174386 - (CVE-2020-15863) VUL-0: CVE-2020-15863: kvm,qemu: stack-based overflow in xgmac_enet_send() in hw/net/xgmac.c

(CVE-2020-15863)
Summary:	VUL-0: CVE-2020-15863: kvm,qemu: stack-based overflow in xgmac_enet_send() in...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Major
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/264082/
Whiteboard:	CVSSv3.1:SUSE:CVE-2020-15863:8.2:(AV:...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2020-07-22 12:44 UTC by Wolfgang Frisch
Modified:	2021-08-23 13:50 UTC (History)
CC List:	4 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Wolfgang Frisch 2020-07-22 12:44:23 UTC

CVE-2020-15863

A buffer overflow vulnerability was found in the XGMAC device of the QEMU emulator. XGMAC is an Ethernet controller used by the "highbank" and "midway" ARM emulated machines. The flaw lies in the xgmac_enet_send() function in hw/net/xgmac.c. Under certain circumstances, this may lead to a denial of service condition or potential code execution.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1853725
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15863
http://seclists.org/oss-sec/2020/q3/49
https://git.qemu.org/?p=qemu.git;a=commit;h=5519724a13664b43e225ca05351c60b4468e4555

Comment 2 Wolfgang Frisch 2020-07-22 12:49:05 UTC

SUSE:SLE-11:Update       qemu      Not affected [1]
SUSE:SLE-11-SP1:Update   kvm       Not affected [1]
SUSE:SLE-11-SP3:Update   kvm       Not affected [1]
SUSE:SLE-11-SP4:Update   kvm       Not affected [1]
SUSE:SLE-12-SP2:Update   qemu      Affected
SUSE:SLE-12-SP3:Update   qemu      Affected
SUSE:SLE-12-SP4:Update   qemu      Affected
SUSE:SLE-12-SP5:Update   qemu      Affected
SUSE:SLE-15:Update       qemu      Affected
SUSE:SLE-15-SP1:Update   qemu      Affected
SUSE:SLE-15-SP2:Update   qemu      Affected

[1] XGMAC Ethernet not supported

Comment 5 Swamp Workflow Management 2020-09-24 19:16:46 UTC

SUSE-SU-2020:2743-1: An update that fixes four vulnerabilities is now available.

Category: security (important)
Bug References: 1172384,1174386,1174641,1175441
CVE References: CVE-2020-13361,CVE-2020-14364,CVE-2020-15863,CVE-2020-16092
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    qemu-3.1.1.1-45.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 6 Swamp Workflow Management 2020-10-07 16:16:51 UTC

SUSE-SU-2020:2877-1: An update that solves four vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1174386,1174641,1174863,1175370,1175441,1176494
CVE References: CVE-2020-14364,CVE-2020-15863,CVE-2020-16092,CVE-2020-24352
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP2 (src):    qemu-4.2.1-11.10.1
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    qemu-4.2.1-11.10.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 7 Swamp Workflow Management 2020-10-13 04:14:30 UTC

openSUSE-SU-2020:1664-1: An update that solves four vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1174386,1174641,1174863,1175370,1175441,1176494
CVE References: CVE-2020-14364,CVE-2020-15863,CVE-2020-16092,CVE-2020-24352
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    qemu-4.2.1-lp152.9.6.1, qemu-linux-user-4.2.1-lp152.9.6.1, qemu-testsuite-4.2.1-lp152.9.6.1

Comment 8 OBSbugzilla Bot 2020-12-08 23:50:11 UTC

This is an autogenerated message for OBS integration:
This bug (1174386) was mentioned in
https://build.opensuse.org/request/show/854157 Factory / qemu

Comment 12 Bruce Rogers 2021-04-07 01:29:55 UTC

Fix submitted in maintenance request for all affected qemu releases. Returning to security team.

Comment 15 Swamp Workflow Management 2021-04-16 16:18:55 UTC

SUSE-SU-2021:1245-1: An update that solves 25 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178049,1178174,1178565,1178934,1179466,1179467,1179468,1179686,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968,1183979
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Manager Server 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Manager Retail Branch Server 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Manager Proxy 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server 15-SP1-BCL (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    qemu-3.1.1.1-9.24.3
SUSE Enterprise Storage 6 (src):    qemu-3.1.1.1-9.24.3
SUSE CaaS Platform 4.0 (src):    qemu-3.1.1.1-9.24.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 16 Swamp Workflow Management 2021-04-16 16:22:33 UTC

SUSE-SU-2021:1240-1: An update that solves 22 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179467,1179468,1180523,1181108,1181639,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    qemu-2.9.1-6.47.1
SUSE OpenStack Cloud 8 (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    qemu-2.9.1-6.47.1
HPE Helion Openstack 8 (src):    qemu-2.9.1-6.47.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 17 Swamp Workflow Management 2021-04-16 16:25:48 UTC

SUSE-SU-2021:1241-1: An update that solves 24 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1112499,1119115,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    qemu-2.11.2-5.29.1
SUSE OpenStack Cloud 9 (src):    qemu-2.11.2-5.29.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    qemu-2.11.2-5.29.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    qemu-2.11.2-5.29.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 18 Swamp Workflow Management 2021-04-16 16:29:18 UTC

SUSE-SU-2021:1244-1: An update that solves 24 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1129962,1154790,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178565,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise Server 15-LTSS (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    qemu-2.11.2-9.43.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 19 Swamp Workflow Management 2021-04-22 19:16:17 UTC

SUSE-SU-2021:1305-1: An update that solves 21 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179467,1180523,1181108,1181639,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP2-LTSS-SAP (src):    qemu-2.6.2-41.62.1
SUSE Linux Enterprise Server 12-SP2-LTSS-ERICSSON (src):    qemu-2.6.2-41.62.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    qemu-2.6.2-41.62.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 22 Swamp Workflow Management 2021-08-03 16:21:36 UTC

SUSE-SU-2021:14772-1: An update that fixes 8 vulnerabilities is now available.

Category: security (important)
Bug References: 1173612,1174386,1178683,1180523,1181933,1186473,1187364,1187367
CVE References: CVE-2020-11947,CVE-2020-15469,CVE-2020-15863,CVE-2020-25707,CVE-2021-20221,CVE-2021-3416,CVE-2021-3592,CVE-2021-3594
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    kvm-1.4.2-60.37.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 23 José Ricardo Ziviani 2021-08-03 20:46:01 UTC

SLE11 SP3 and SP4 fixed now. Returning bug the security team.

Thank you!!

Comment 24 Swamp Workflow Management 2021-08-06 13:34:20 UTC

SUSE-SU-2021:14774-1: An update that solves 8 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1031692,1173612,1174386,1178683,1180523,1181933,1186473,1187364,1187367
CVE References: CVE-2020-11947,CVE-2020-15469,CVE-2020-15863,CVE-2020-25707,CVE-2021-20221,CVE-2021-3416,CVE-2021-3592,CVE-2021-3594
JIRA References: 
Sources used:
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    kvm-1.4.2-53.41.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 25 Marcus Meissner 2021-08-23 13:50:24 UTC

released