CVE-2020-8608

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• QEMU: Slirp: potential OOB access due to unsafe snprintf() usages (CVE-2020-8608)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• useradd and groupadd fail under rootless Buildah and podman [stream-container-tools-Rocky Linux8-Rocky Linux-8.1.1] (BZ#1803495)

• Podman support for FIPS Mode requires a bind mount inside the container [stream-container-tools-Rocky Linux8-Rocky Linux-8.1.1/buildah] (BZ#1804188)

• Podman support for FIPS Mode requires a bind mount inside the container [stream-container-tools-Rocky Linux8-Rocky Linux-8.1.1/podman] (BZ#1804194)

• fuse-overlayfs segfault [stream-container-tools-Rocky Linux8-Rocky Linux-8.1.1/fuse-overlayfs] (BZ#1805016)

• buildah COPY command is slow when .dockerignore file is not present [stream-container-tools-Rocky Linux8-Rocky Linux-8.1.1/buildah] (BZ#1806119)

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• QEMU: Slirp: potential OOB access due to unsafe snprintf() usages (CVE-2020-8608)

• QEMU: vnc: memory leakage upon disconnect (CVE-2019-20382)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• QEMU: Slirp: potential OOB access due to unsafe snprintf() usages (CVE-2020-8608)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• useradd and groupadd fail under rootless Buildah and podman [stream-container-tools-rhel8-rhel-8.1.1] (BZ#1803495)

• Podman support for FIPS Mode requires a bind mount inside the container [stream-container-tools-rhel8-rhel-8.1.1/buildah] (BZ#1804188)

• Podman support for FIPS Mode requires a bind mount inside the container [stream-container-tools-rhel8-rhel-8.1.1/podman] (BZ#1804194)

• fuse-overlayfs segfault [stream-container-tools-rhel8-rhel-8.1.1/fuse-overlayfs] (BZ#1805016)

• buildah COPY command is slow when .dockerignore file is not present [stream-container-tools-rhel8-rhel-8.1.1/buildah] (BZ#1806119)

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• QEMU: Slirp: potential OOB access due to unsafe snprintf() usages (CVE-2020-8608)

• QEMU: vnc: memory leakage upon disconnect (CVE-2019-20382)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for qemu fixes the following issues:

• CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1161066).
• CVE-2019-15034: Fixed a buffer overflow in hw/display/bochs-display.c due to improper PCI config space allocation (bsc#1166379).
• CVE-2020-1711: Fixed an out of bounds heap buffer access iscsi_co_block_status() routine which could have allowed a remote denial of service or arbitrary code with privileges of the QEMU process on the host (bsc#1166240).
• CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() routine while emulating the identification protocol and copying message data to a socket buffer (bsc#1123156).
• CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1163018).
• CVE-2019-20382: Fixed a memory leak in the VNC display driver which could have led to exhaustion of the host memory leading to a potential Denial of service (bsc#1165776).
• Fixed a live migration error (bsc#1154790).
• Fixed an issue where migrating VMs on KVM gets missing features:ospke error (bsc#1162729).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3546: Fix out-of-bounds write in virgl_cmd_get_capset (bsc#1185981)
• CVE-2021-3544: Fix memory leaks found in the virtio vhost-user GPU device (bsc#1186010)
• CVE-2021-3545: Fix information disclosure due to uninitialized memory read (bsc#1185990)
• CVE-2020-25085: Fix out-of-bounds access issue while doing multi block SDMA (bsc#1176681)
• CVE-2020-10756: Fix out-of-bounds read information disclosure in icmp6_send_echoreply(bsc#1172380)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975)

Non-security issues fixed:

• Fix issue where s390 guest fails to find zipl boot menu index (bsc#1183979)
• QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
• Host CPU microcode revision will be visible inside VMs when the proper CPU-model is used (jsc#SLE-17785):
• Fix testsuite error (bsc#1184574)
• Fix qemu crash with iothread when block commit after snapshot (bsc#1187013)
• Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)
• Use RCU to avoid race during scsi hotplug/hotunplug (bsc#1184574)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for qemu fixes the following issues:

• Switch method of splitting off hw-s390x-virtio-gpu-ccw.so as a module to what was accepted upstream (bsc#1181103)
• Fix OOB access in sdhci interface (CVE-2020-17380, bsc#1175144, CVE-2020-25085, bsc#1176681, CVE-2021-3409, bsc#1182282)
• Fix potential privilege escalation in virtiofsd tool (CVE-2021-20263, bsc#1183373)
• Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)
• Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)
• Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
• QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-3419, bsc#1182975)

These are all security issues fixed in the qemu-6.1.0-32.1 package on the GA media of openSUSE Tumbleweed.

This update for qemu fixes the following issues:

• CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1161066).
• CVE-2019-15034: Fixed a buffer overflow in hw/display/bochs-display.c due to improper PCI config space allocation (bsc#1166379).
• CVE-2020-1711: Fixed an out of bounds heap buffer access iscsi_co_block_status() routine which could have allowed a remote denial of service or arbitrary code with privileges of the QEMU process on the host (bsc#1166240).
• CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() routine while emulating the identification protocol and copying message data to a socket buffer (bsc#1123156).
• CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1163018).
• CVE-2019-20382: Fixed a memory leak in the VNC display driver which could have led to exhaustion of the host memory leading to a potential Denial of service (bsc#1165776).
• Fixed a live migration error (bsc#1154790).
• Fixed an issue where migrating VMs on KVM gets missing features:ospke error (bsc#1162729).

This update for qemu fixes the following issues:

• CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1161066).
• CVE-2019-15034: Fixed a buffer overflow in hw/display/bochs-display.c due to improper PCI config space allocation (bsc#1166379).
• CVE-2020-1711: Fixed an out of bounds heap buffer access iscsi_co_block_status() routine which could have allowed a remote denial of service or arbitrary code with privileges of the QEMU process on the host (bsc#1166240).
• CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() routine while emulating the identification protocol and copying message data to a socket buffer (bsc#1123156).
• CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1163018).
• CVE-2019-20382: Fixed a memory leak in the VNC display driver which could have led to exhaustion of the host memory leading to a potential Denial of service (bsc#1165776).
• Fixed live migration errors (bsc#1154790, bsc#1156794, bsc#1156642).
• Fixed an issue where migrating VMs on KVM gets missing features:ospke error (bsc#1162729).
• Fixed an issue where booting up a guest system with mdev passthrough device as installation device was failing (bsc#1158880).

This update for kvm fixes the following issues:

Security issues fixed:

• CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation (bsc#1146873).
• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• CVE-2019-15890: Fixed a use-after-free during packet reassembly in slirp (bsc#1149811).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

This update for xen fixes the following issues:

• bsc#1174543 - secure boot related fixes
• bsc#1163019 - CVE-2020-8608: potential OOB access due to unsafe snprintf() usages
• bsc#1169392 - CVE-2020-11742: Bad continuation handling in GNTTABOP_copy
• bsc#1168140 - CVE-2020-11740, CVE-2020-11741: multiple xenoprof issues
• bsc#1161181 - CVE-2020-7211: potential directory traversal using relative paths via tftp server on Windows host
• bsc#1157888 - CVE-2019-19579: Device quarantine for alternate pci assignment methods
• bsc#1158004 - CVE-2019-19583: VMX: VMentry failure with debug exceptions and blocked states
• bsc#1158005 - CVE-2019-19578: Linear pagetable use / entry miscounts
• bsc#1158006 - CVE-2019-19580: Further issues with restartable PV type change operations
• bsc#1158007 - CVE-2019-19577: dynamic height for the IOMMU pagetables
• bsc#1154448 - CVE-2019-18420: VCPUOP_initialise DoS
• bsc#1154456 - CVE-2019-18425: missing descriptor table limit checking in x86 PV emulation
• bsc#1154458 - CVE-2019-18421: Issues with restartable PV type change operations
• bsc#1154461 - CVE-2019-18424: passed through PCI devices may corrupt host memory after deassignment
• bsc#1155945 - CVE-2018-12207: Machine Check Error Avoidance on Page Size Change (aka IFU issue)
• bsc#1152497 - CVE-2019-11135: TSX Asynchronous Abort (TAA) issue

This update for xen fixes the following issues:

• bsc#1174543 - secure boot related fixes
• bsc#1163019 - CVE-2020-8608: potential OOB access due to unsafe snprintf() usages
• bsc#1169392 - CVE-2020-11742: Bad continuation handling in GNTTABOP_copy
• bsc#1168140 - CVE-2020-11740, CVE-2020-11741: multiple xenoprof issues
• bsc#1161181 - CVE-2020-7211: potential directory traversal using relative paths via tftp server on Windows host
• bsc#1154456 - CVE-2019-18425: missing descriptor table limit checking in x86 PV emulation
• bsc#1154458 - CVE-2019-18421: Issues with restartable PV type change operations

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2019-20382: Fixed a potential DoS due to a memory leak in VNC disconnect (bsc#1165776).
• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

Non-security issue fixed:

• Miscellaneous fixes to the in-package support documentation.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation (bsc#1146873).
• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• CVE-2019-15890: Fixed a use-after-free during packet reassembly in slirp (bsc#1149811).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2019-20382: Fixed a potential DoS due to a memory leak in VNC disconnect (bsc#1165776).
• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

Non-security issue fixed:

• Miscellaneous fixes to the in-package support documentation.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation (bsc#1146873).
• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• CVE-2019-15890: Fixed a use-after-free during packet reassembly in slirp (bsc#1149811).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation (bsc#1146873).
• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• CVE-2019-15890: Fixed a use-after-free during packet reassembly in slirp (bsc#1149811).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

Non-security issue fixed:

• Make sure that required memory is mapped properly during an incoming migration of a Xen HVM domU (bsc#1160024).

This update for xen fixes the following issues:

• bsc#1174543 - secure boot related fixes
• bsc#1163019 - CVE-2020-8608: Potential OOB access due to unsafe snprintf() usages

This update for xen fixes the following issues:

• bsc#1174543 - secure boot related fixes
• bsc#1163019 - CVE-2020-8608: Potential OOB access due to unsafe snprintf() usages

This update for xen fixes the following issues:

• bsc#1174543 - secure boot related fixes
• bsc#1163019 - CVE-2020-8608: Potential OOB access due to unsafe snprintf() usages
• bsc#1169392 - CVE-2020-11742: Bad continuation handling in GNTTABOP_copy
• bsc#1168140 - CVE-2020-11740, CVE-2020-11741: Multiple xenoprof issues
• bsc#1168142 - CVE-2020-11739: Missing memory barriers in read-write unlock paths

This update for xen fixes the following issues:

• CVE-2020-29480: Fixed an issue which could have allowed leak of non-sensitive data to administrator guests (bsc#117949 XSA-115).
• CVE-2020-29481: Fixed an issue which could have allowd to new domains to inherit existing node permissions (bsc#1179498 XSA-322).
• CVE-2020-29483: Fixed an issue where guests could disturb domain cleanup (bsc#1179502 XSA-325).
• CVE-2020-29484: Fixed an issue where guests could crash xenstored via watchs (bsc#1179501 XSA-324).
• CVE-2020-29566: Fixed an undue recursion in x86 HVM context switch code (bsc#1179506 XSA-348).
• CVE-2020-29570: Fixed an issue where FIFO event channels control block related ordering (bsc#1179514 XSA-358).
• CVE-2020-29571: Fixed an issue where FIFO event channels control structure ordering (bsc#1179516 XSA-359).
• CVE-2020-29130: Fixed an out-of-bounds access while processing ARP packets (bsc#1179477).
• Fixed an issue where dump-core shows missing nr_pages during core (bsc#1176782).
• Multiple other bugs (bsc#1027519)

This update for kvm fixes the following issues:

• Fix OOB read and write due to integer overflow in sm501_2d_operation() in hw/display/sm501.c (CVE-2020-12829, bsc#1172385)
• Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)
• Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)
• Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)
• Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)
• Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)
• Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)
• Fix DoS in e1000 emulated device (CVE-2021-20257 bsc#1182577)
• Fix OOB access in SLIRP ARP packet processing (CVE-2020-29130, bsc#1179467)
• Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441)
• Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)
• Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
• Fix use-after-free in slirp (CVE-2019-15890 bsc#1149811)
• Fix for similar problems as for the original fix prompting this issue (CVE-2019-6778 bsc#1123156)
• Fix potential OOB accesses in slirp (CVE-2020-8608 bsc#1163018 CVE-2020-7039 bsc#1161066)
• Fix use after free in slirp (CVE-2020-1983 bsc#1170940)
• Fix potential DOS in lsi scsi controller emulation (CVE-2019-12068 bsc#1146873)
• Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384)
• Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)

This update for qemu fixes the following issues:

• Fix OOB access during mmio operations (CVE-2020-13754, bsc#1172382)
• Fix sPAPR emulator leaks the host hardware identity (CVE-2019-8934, bsc#1126455)
• Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380)
• Fix out-of-bound heap buffer access via an interrupt ID field (CVE-2021-20221, bsc#1181933)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975, bsc#1031692, bsc#1094725)

This update for qemu fixes the following issues:

• Fix out-of-bounds access issue while doing multi block SDMA (CVE-2020-25085, bsc#1176681)
• Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380)
• QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
• Change dependency from CONFIG_VFIO back to CONFIG_LINUX (bsc#1179725)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975)