CVE-2020-1711

An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:Rocky Linux module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• QEMU: block: iscsi: OOB heap access via an unexpected response of iSCSI Server (CVE-2020-1711)

• QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• libvirtd: error : virCPUx86UpdateLive:3110 : operation failed: guest CPU doesn't match specification: missing features: fxsr_opt (BZ#1809510)

An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• QEMU: block: iscsi: OOB heap access via an unexpected response of iSCSI Server (CVE-2020-1711)

• QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• libvirtd: error : virCPUx86UpdateLive:3110 : operation failed: guest CPU doesn't match specification: missing features: fxsr_opt (BZ#1809510)

This update for qemu fixes the following issues:

• CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1161066).
• CVE-2019-15034: Fixed a buffer overflow in hw/display/bochs-display.c due to improper PCI config space allocation (bsc#1166379).
• CVE-2020-1711: Fixed an out of bounds heap buffer access iscsi_co_block_status() routine which could have allowed a remote denial of service or arbitrary code with privileges of the QEMU process on the host (bsc#1166240).
• CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() routine while emulating the identification protocol and copying message data to a socket buffer (bsc#1123156).
• CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1163018).
• CVE-2019-20382: Fixed a memory leak in the VNC display driver which could have led to exhaustion of the host memory leading to a potential Denial of service (bsc#1165776).
• Fixed a live migration error (bsc#1154790).
• Fixed an issue where migrating VMs on KVM gets missing features:ospke error (bsc#1162729).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

These are all security issues fixed in the qemu-6.1.0-32.1 package on the GA media of openSUSE Tumbleweed.

This update for qemu fixes the following issues:

• CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1161066).
• CVE-2019-15034: Fixed a buffer overflow in hw/display/bochs-display.c due to improper PCI config space allocation (bsc#1166379).
• CVE-2020-1711: Fixed an out of bounds heap buffer access iscsi_co_block_status() routine which could have allowed a remote denial of service or arbitrary code with privileges of the QEMU process on the host (bsc#1166240).
• CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() routine while emulating the identification protocol and copying message data to a socket buffer (bsc#1123156).
• CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1163018).
• CVE-2019-20382: Fixed a memory leak in the VNC display driver which could have led to exhaustion of the host memory leading to a potential Denial of service (bsc#1165776).
• Fixed a live migration error (bsc#1154790).
• Fixed an issue where migrating VMs on KVM gets missing features:ospke error (bsc#1162729).

This update for qemu fixes the following issues:

• CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1161066).
• CVE-2019-15034: Fixed a buffer overflow in hw/display/bochs-display.c due to improper PCI config space allocation (bsc#1166379).
• CVE-2020-1711: Fixed an out of bounds heap buffer access iscsi_co_block_status() routine which could have allowed a remote denial of service or arbitrary code with privileges of the QEMU process on the host (bsc#1166240).
• CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() routine while emulating the identification protocol and copying message data to a socket buffer (bsc#1123156).
• CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1163018).
• CVE-2019-20382: Fixed a memory leak in the VNC display driver which could have led to exhaustion of the host memory leading to a potential Denial of service (bsc#1165776).
• Fixed live migration errors (bsc#1154790, bsc#1156794, bsc#1156642).
• Fixed an issue where migrating VMs on KVM gets missing features:ospke error (bsc#1162729).
• Fixed an issue where booting up a guest system with mdev passthrough device as installation device was failing (bsc#1158880).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2019-20382: Fixed a potential DoS due to a memory leak in VNC disconnect (bsc#1165776).
• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

Non-security issue fixed:

• Miscellaneous fixes to the in-package support documentation.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation (bsc#1146873).
• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• CVE-2019-15890: Fixed a use-after-free during packet reassembly in slirp (bsc#1149811).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2019-20382: Fixed a potential DoS due to a memory leak in VNC disconnect (bsc#1165776).
• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

Non-security issue fixed:

• Miscellaneous fixes to the in-package support documentation.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation (bsc#1146873).
• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• CVE-2019-15890: Fixed a use-after-free during packet reassembly in slirp (bsc#1149811).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).
• CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation (bsc#1146873).
• CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).
• CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).
• CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).
• CVE-2019-15890: Fixed a use-after-free during packet reassembly in slirp (bsc#1149811).
• Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

Non-security issue fixed:

• Make sure that required memory is mapped properly during an incoming migration of a Xen HVM domU (bsc#1160024).

Felipe Franciosi, Raphael Norwitz, and Peter Turschmid discovered that QEMU incorrectly handled iSCSI server responses. A remote attacker in control of the iSCSI server could use this issue to cause QEMU to crash, leading to a denial of service, or possibly execute arbitrary code. (CVE-2020-1711)

It was discovered that the QEMU libslirp component incorrectly handled memory. A remote attacker could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-7039, CVE-2020-8608)