CVE-2015-3456

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.

Updated qemu packages fix security vulnerability:

An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest (CVE-2015-3456).

Updated virtualbox packages fixes security vulnerability

This update provides the 4.3.28 maintenance release fixing the following security issue:

The Floppy Disk Controller (FDC) in QEMU, XEN, KVM and virtualbox allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the FD_CMD_READ_ID, FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM (CVE-2015-3456).

For other fixes in the maintenance release, read the referenced changelog.

This xen update is based on upstream 4.5.2 maintenance release, and fixes the following security issues:

The vgic_v2_to_sgi function in arch/arm/vgic-v2.c in Xen 4.5.x, when running on ARM hardware with general interrupt controller (GIC) version 2, allows local guest users to cause a denial of service (host crash) by writing an invalid value to the GICD.SGIR register (CVE-2015-0268).

The ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local guests to cause a denial of service by causing a large number messages to be logged (CVE-2015-1563).

The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size (CVE-2015-2044).

The HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not properly initialize data structures, which allows local guest users to obtain sensitive information via unspecified vectors (CVE-2015-2045).

Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (CVE-2015-2150).

The x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands, which allows local guest users to obtain sensitive information, cause a denial of service (memory corruption), or possibly execute arbitrary code via unspecified vectors (CVE-2015-2151).

Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support (CVE-2015-2152).

Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations (CVE-2015-2751).

The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptable, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm) (CVE-2015-2752).

QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (CVE-2015-2756).

Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set (CVE-2015-3209).

Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through 4.5.x allows local guest administrators to gain privileges via a long configuration argument (CVE-2015-3259).

Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request (CVE-2015-3340).

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other…

These are all security issues fixed in the python-virtualbox-5.1.10-2.5 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the xen-4.7.0_12-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the qemu-2.6.1-1.5 package on the GA media of openSUSE Tumbleweed.

kvm has been updated to fix issues in the embedded qemu:

* 

  CVE-2014-0223: An integer overflow flaw was found in the QEMU block
  driver for QCOW version 1 disk images. A user able to alter the QEMU
  disk image files loaded by a guest could have used this flaw to
  corrupt QEMU process memory on the host, which could potentially have
  resulted in arbitrary code execution on the host with the privileges
  of the QEMU process.

* 

  CVE-2014-3461: A user able to alter the savevm data (either on the
  disk or over the wire during migration) could have used this flaw to
  to corrupt QEMU process memory on the (destination) host, which could
  have potentially resulted in arbitrary code execution on the host
  with the privileges of the QEMU process.

* 

  CVE-2014-0222: An integer overflow flaw was found in the QEMU block
  driver for QCOW version 1 disk images. A user able to alter the QEMU
  disk image files loaded by a guest could have used this flaw to
  corrupt QEMU process memory on the host, which could have potentially
  resulted in arbitrary code execution on the host with the privileges
  of the QEMU process.

Non-security bugs fixed:

* Fix exceeding IRQ routes that could have caused freezes of guests.
  (bnc#876842)
* Fix CPUID emulation bugs that may have broken Windows guests with
  newer -cpu types (bnc#886535)

Security Issues:

* CVE-2014-0222
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222>
* CVE-2014-0223
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223>
* CVE-2014-3461
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3461>

kvm has been updated to fix issues in the embedded qemu:

* 

  CVE-2014-0223: An integer overflow flaw was found in the QEMU block
  driver for QCOW version 1 disk images. A user able to alter the QEMU
  disk image files loaded by a guest could have used this flaw to
  corrupt QEMU process memory on the host, which could potentially have
  resulted in arbitrary code execution on the host with the privileges
  of the QEMU process.

* 

  CVE-2014-3461: A user able to alter the savevm data (either on the
  disk or over the wire during migration) could have used this flaw to
  to corrupt QEMU process memory on the (destination) host, which could
  have potentially resulted in arbitrary code execution on the host
  with the privileges of the QEMU process.

* 

  CVE-2014-0222: An integer overflow flaw was found in the QEMU block
  driver for QCOW version 1 disk images. A user able to alter the QEMU
  disk image files loaded by a guest could have used this flaw to
  corrupt QEMU process memory on the host, which could have potentially
  resulted in arbitrary code execution on the host with the privileges
  of the QEMU process.

Non-security bugs fixed:

* Fix exceeding IRQ routes that could have caused freezes of guests.
  (bnc#876842)
* Fix CPUID emulation bugs that may have broken Windows guests with
  newer -cpu types (bnc#886535)

Security Issues:

* CVE-2014-0222
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222>
* CVE-2014-0223
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223>
* CVE-2014-3461
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3461>

qemu / kvm was updated to fix a security issue and some bugs.

Security issue fixed:

• CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host.

• CVE-2015-1779: Fixed insufficient resource limiting in the VNC websockets decoder.

Bugs fixed:

• qemu truncates vhd images in virt-rescue (bsc#886378)

• Update kvm-supported.txt with the current rbd support status.

• enable rbd build on x86_64 (qemu-block-rbd package) (FATE#318349)

XEN was updated to fix two security issues and bugs.

Security issues fixed:

• CVE-2015-3340: Xen did not initialize certain fields, which allowed certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.

• CVE-2015-2751: Xen, when using toolstack disaggregation, allowed remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.

• CVE-2015-2752: The XEN_DOMCTL_memory_mapping hypercall in Xen, when using a PCI passthrough device, was not preemptable, which allowed local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm).

• CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host.

Bugs fixed:

• xentop: Fix memory leak on read failure

Xen was updated to fix two security issues and a bug:

* CVE-2015-3456: A buffer overflow in the floppy drive emulation, which
  could be used to carry out denial of service attacks or potential
  code execution against the host. This vulnerability is also known as
  VENOM.
* CVE-2015-3340: Xen did not initialize certain fields, which allowed
  certain remote service domains to obtain sensitive information from
  memory via a (1) XEN_DOMCTL_gettscinfo or (2)
  XEN_SYSCTL_getdomaininfolist request.
* An exception in setCPUAffinity when restoring guests. (bsc#910441)

Security Issues:

* CVE-2015-3456
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456>
* CVE-2015-3340
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3340>

The kvm qemu vt100 emulation was affected by a problem where specific vt100 sequences could have been used by guest users to affect the host. (CVE-2012-3515 aka XSA-17).

Also a temp file race was fixed. (CVE-2012-2652)

Security Issue reference:

* CVE-2012-3515
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515>
* CVE-2012-2652
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2652>

This update fixes the following security issues in Xen:

* CVE-2012-5510: Grant table version switch list corruption
  vulnerability (XSA-26)
* CVE-2012-5511: Several HVM operations do not validate the range of
  their inputs (XSA-27)
* CVE-2012-5513: XENMEM_exchange may overwrite hypervisor memory
  (XSA-29)
* CVE-2012-5514: Missing unlock in
  guest_physmap_mark_populate_on_demand() (XSA-30)
* CVE-2012-5515: Several memory hypercall operations allow invalid
  extent order values (XSA-31)

Also the following fix has been applied:

* bnc#777628 - guest 'disappears' after live migration
  Updated block-dmmd script

Security Issues references:

* CVE-2012-5513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5513>
* CVE-2012-5514
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5514>
* CVE-2012-5511
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5511>
* CVE-2012-5510
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5510>
* CVE-2012-5515
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5515>

This update fixes a file permission issue with qga (the QEMU Guest Agent) from the qemu/kvm package and includes several bug-fixes.

(bnc#818182) (CVE-2013-2007) (bnc#786813) (bnc#725008) (bnc#712137) (bnc#824340)

Security Issues:

* CVE-2013-2007
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2007>

XEN has been updated to fix various bugs and security issues:

* 

  CVE-2013-0153: (XSA 36) To avoid an erratum in early hardware, the
  Xen AMD IOMMU code by default choose to use a single interrupt
  remapping table for the whole system. This sharing implied that any
  guest with a passed through PCI device that is bus mastering capable
  can inject interrupts into other guests, including domain 0. This has
  been disabled for AMD chipsets not capable of it.

* 

  CVE-2012-6075: qemu: The e1000 had overflows under some conditions,
  potentially corrupting memory.

* 

  CVE-2013-0154: (XSA 37) Hypervisor crash due to incorrect ASSERT
  (debug build only)

* 

  CVE-2012-5634: (XSA-33) A VT-d interrupt remapping source validation
  flaw was fixed.

Also the following bugs have been fixed:

* bnc#805094 - xen hot plug attach/detach fails
* bnc#802690 - domain locking can prevent a live migration from
  completing
* bnc#797014 - no way to control live migrations
      o fix logic error in stdiostream_progress
      o restore logging in xc_save
      o add options to control migration tunables
* bnc#806736: enabling xentrace crashes hypervisor
* Upstream patches from Jan 26287-sched-credit-pick-idle.patch
  26501-VMX-simplify-CR0-update.patch
  26502-VMX-disable-SMEP-when-not-paging.patch
  26516-ACPI-parse-table-retval.patch (Replaces
  CVE-2013-0153-xsa36.patch) 26517-AMD-IOMMU-clear-irtes.patch
  (Replaces CVE-2013-0153-xsa36.patch)
  26518-AMD-IOMMU-disable-if-SATA-combined-mode.patch (Replaces
  CVE-2013-0153-xsa36.patch)
  26519-AMD-IOMMU-perdev-intremap-default.patch (Replaces
  CVE-2013-0153-xsa36.patch) 26526-pvdrv-no-devinit.patch
  26531-AMD-IOMMU-IVHD-special-missing.patch (Replaces
  CVE-2013-0153-xsa36.patch)
* bnc#798188 - Add $network to xend initscript dependencies
* bnc#799694 - Unable to dvd or cdrom-boot DomU after xen-tools update
  Fixed with update to Xen version 4.1.4
* bnc#800156 - L3: HP iLo Generate NMI function not working in XEN
  kernel
* Upstream patches from Jan 26404-x86-forward-both-NMI-kinds.patch
  26427-x86-AMD-enable-WC+.patch
* bnc#793927 - Xen VMs with more than 2 disks randomly fail to start
* Upstream patches from Jan 26332-x86-compat-show-guest-stack-mfn.patch
  26333-x86-get_page_type-assert.patch (Replaces
  CVE-2013-0154-xsa37.patch)
  26340-VT-d-intremap-verify-legacy-bridge.patch (Replaces
  CVE-2012-5634-xsa33.patch) 26370-libxc-x86-initial-mapping-fit.patch
* Update to Xen 4.1.4 c/s 23432
* Update xenpaging.guest-memusage.patch add rule for xenmem to avoid
  spurious build failures
* Upstream patches from Jan 26179-PCI-find-next-cap.patch
  26183-x86-HPET-masking.patch 26188-x86-time-scale-asm.patch
  26200-IOMMU-debug-verbose.patch 26203-x86-HAP-dirty-vram-leak.patch
  26229-gnttab-version-switch.patch (Replaces
  CVE-2012-5510-xsa26.patch) 26230-x86-HVM-limit-batches.patch
  (Replaces CVE-2012-5511-xsa27.patch)
  26231-memory-exchange-checks.patch (Replaces
  CVE-2012-5513-xsa29.patch) 26232-x86-mark-PoD-error-path.patch
  (Replaces CVE-2012-5514-xsa30.patch) 26233-memop-order-checks.patch
  (Replaces CVE-2012-5515-xsa31.patch)
  26235-IOMMU-ATS-max-queue-depth.patch
  26272-x86-EFI-makefile-cflags-filter.patch
  26294-x86-AMD-Fam15-way-access-filter.patch CVE-2013-0154-xsa37.patch
* Restore c/s 25751 in 23614-x86_64-EFI-boot.patch. Modify the EFI
  Makefile to do additional filtering.

Security Issue references:

* CVE-2013-0153
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0153>
* CVE-2012-6075
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6075>
* CVE-2012-5634
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5634>

kvm has been updated to fix issues in the embedded qemu:

* 

  CVE-2014-0223: An integer overflow flaw was found in the QEMU block
  driver for QCOW version 1 disk images. A user able to alter the QEMU
  disk image files loaded by a guest could have used this flaw to
  corrupt QEMU process memory on the host, which could potentially have
  resulted in arbitrary code execution on the host with the privileges
  of the QEMU process.

* 

  CVE-2014-3461: A user able to alter the savevm data (either on the
  disk or over the wire during migration) could have used this flaw to
  to corrupt QEMU process memory on the (destination) host, which could
  have potentially resulted in arbitrary code execution on the host
  with the privileges of the QEMU process.

* 

  CVE-2014-0222: An integer overflow flaw was found in the QEMU block
  driver for QCOW version 1 disk images. A user able to alter the QEMU
  disk image files loaded by a guest could have used this flaw to
  corrupt QEMU process memory on the host, which could have potentially
  resulted in arbitrary code execution on the host with the privileges
  of the QEMU process.

Non-security bugs fixed:

* Fix exceeding IRQ routes that could have caused freezes of guests.
  (bnc#876842)
* Fix CPUID emulation bugs that may have broken Windows guests with
  newer -cpu types (bnc#886535)

Security Issues:

* CVE-2014-0222
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0222>
* CVE-2014-0223
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0223>
* CVE-2014-3461
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3461>

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.

Jason Geffner discovered that QEMU incorrectly handled the virtual floppy driver. This issue is known as VENOM. A malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the QEMU process. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2015-3456)

Daniel P. Berrange discovered that QEMU incorrectly handled VNC websockets. A remote attacker could use this issue to cause QEMU to consume memory, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-1779)

Jan Beulich discovered that QEMU, when used with Xen, didn't properly restrict access to PCI command registers. A malicious guest could use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-2756)