Bugzilla – Bug 1192525
VUL-1: CVE-2021-3930: kvm,qemu: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c
Last modified: 2022-04-20 16:23:29 UTC
rh#2020588 An off-by-one error was found in the SCSI Device emulation in QEMU. It could occur in hw/scsi/scsi-disk.c:mode_sense_page() while processing MODE SELECT commands if 'page' was set to MODE_PAGE_ALLS (0x3f). Specifically, 'page' was used to index the stack-allocated 'mode_sense_valid' buffer (size=0x3f), causing an off-by-one error when trying to access the last element. A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition. References: https://bugzilla.redhat.com/show_bug.cgi?id=2020588 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3930
Affected codestreams for qemu: - SUSE:SLE-12-SP2:Update - SUSE:SLE-12-SP3:Update - SUSE:SLE-12-SP4:Update - SUSE:SLE-12-SP5:Update - SUSE:SLE-15:Update - SUSE:SLE-15-SP1:Update - SUSE:SLE-15-SP2:Update - SUSE:SLE-15-SP3:Update Affected codestreams for kvm: - SUSE:SLE-11-SP3:Update - SUSE:SLE-11-SP4:Update
openSUSE:Factory also affected for qemu. Upstream patch: https://gitlab.com/qemu-project/qemu/-/commit/b3af7fdf9cc537f8f0dd3e2423d83f5c99a457e8
No need to backport to 12SP2 since its LTSS ended on 31 Mar 2021
Hi Liang, is there any update on that?
(In reply to Carlos López from comment #1) > Affected codestreams for qemu: > - SUSE:SLE-12-SP2:Update > - SUSE:SLE-12-SP3:Update > - SUSE:SLE-12-SP4:Update > - SUSE:SLE-12-SP5:Update > - SUSE:SLE-15:Update > - SUSE:SLE-15-SP1:Update > - SUSE:SLE-15-SP2:Update > - SUSE:SLE-15-SP3:Update > > Affected codestreams for kvm: > - SUSE:SLE-11-SP3:Update > - SUSE:SLE-11-SP4:Update > - 15-SP3: https://build.suse.de/package/show/Devel:Virt:SLE-15-SP3/qemu https://build.suse.de/request/show/264265 - 12-SP5: https://build.suse.de/package/show/Devel:Virt:SLE-12-SP5/qemu https://build.suse.de/request/show/264264 I have a few more backports to do, then I'll create the MR-s
(In reply to Dario Faggioli from comment #6) > (In reply to Carlos López from comment #1) > > Affected codestreams for qemu: > > - SUSE:SLE-12-SP2:Update > > - SUSE:SLE-12-SP3:Update > > - SUSE:SLE-12-SP4:Update > > - SUSE:SLE-12-SP5:Update > > - SUSE:SLE-15:Update > > - SUSE:SLE-15-SP1:Update > > - SUSE:SLE-15-SP2:Update > > - SUSE:SLE-15-SP3:Update > > > > Affected codestreams for kvm: > > - SUSE:SLE-11-SP3:Update > > - SUSE:SLE-11-SP4:Update > > So, considering that 15-SP3 and 12-SP5 are done, and considering the support status of the various codestreams and the CVSS score, I'd say that we're currently missing: - SUSE:SLE-12-SP3:Update - SUSE:SLE-15-SP2:Update Can you confirm that this is the case? Thanks!
Close enough, I see the following ones shipping to regular supported prods: - SUSE:SLE-12-SP3:Update/qemu - SUSE:SLE-15-SP1:Update/qemu - SUSE:SLE-15-SP2:Update/qemu - SUSE:SLE-11-SP3:Update/kvm
(In reply to Gianluca Gabrielli from comment #8) > Close enough, I see the following ones shipping to regular supported prods: > - SUSE:SLE-12-SP3:Update/qemu > - SUSE:SLE-15-SP1:Update/qemu > - SUSE:SLE-15-SP2:Update/qemu > - SUSE:SLE-11-SP3:Update/kvm As you correctly reported at bcs#1181361#c20, SUSE:SLE-15-SP1:Update/qemu can be omitted.
(In reply to Gianluca Gabrielli from comment #8) > Close enough, I see the following ones shipping to regular supported prods: > - SUSE:SLE-12-SP3:Update/qemu > - SUSE:SLE-15-SP1:Update/qemu > - SUSE:SLE-15-SP2:Update/qemu > - SUSE:SLE-11-SP3:Update/kvm Exactly. @Dario you can use SMELT to check which codestreams are used in enabled products (disabled == LTSS): https://smelt.suse.de/maintained/?q=qemu https://smelt.suse.de/maintained/?q=kvm SLE-11-SP1:Update/kvm and SLE-11:Update/qemu are not needed because those codestreams are going EOL by the end of this month.
openSUSE-SU-2022:0930-1: An update that solves two vulnerabilities and has 6 fixes is now available. Category: security (important) Bug References: 1178049,1192525,1193364,1193545,1194938,1195161,1196087,1196737 CVE References: CVE-2021-3930,CVE-2022-0358 JIRA References: Sources used: openSUSE Leap 15.3 (src): qemu-5.2.0-150300.112.4, qemu-linux-user-5.2.0-150300.112.3, qemu-testsuite-5.2.0-150300.112.7
SUSE-SU-2022:0930-1: An update that solves two vulnerabilities and has 6 fixes is now available. Category: security (important) Bug References: 1178049,1192525,1193364,1193545,1194938,1195161,1196087,1196737 CVE References: CVE-2021-3930,CVE-2022-0358 JIRA References: Sources used: SUSE Linux Enterprise Module for Server Applications 15-SP3 (src): qemu-5.2.0-150300.112.4 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): qemu-5.2.0-150300.112.4 SUSE Linux Enterprise Micro 5.1 (src): qemu-5.2.0-150300.112.4 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:1151-1: An update that solves two vulnerabilities and has three fixes is now available. Category: security (moderate) Bug References: 1181361,1187529,1192463,1192525,1196737 CVE References: CVE-2021-20196,CVE-2021-3930 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP5 (src): qemu-3.1.1.1-63.4 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:0930-2: An update that solves two vulnerabilities and has 6 fixes is now available. Category: security (important) Bug References: 1178049,1192525,1193364,1193545,1194938,1195161,1196087,1196737 CVE References: CVE-2021-3930,CVE-2022-0358 JIRA References: Sources used: SUSE Linux Enterprise Micro 5.2 (src): qemu-5.2.0-150300.112.4 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.