CVE-2018-7858

Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.

These are all security issues fixed in the qemu-6.1.0-32.1 package on the GA media of openSUSE Tumbleweed.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation (bsc#1123156).
• CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493).
• CVE-2018-19489: Fixed a denial of service vulnerability in virtfs (bsc#1117275).
• CVE-2018-19364: Fixed a use-after-free if the virtfs interface resulting in a denial of service (bsc#1116717).
• CVE-2018-7858: Fixed a denial of service which could occur while updating the VGA display, after guest has adjusted the display dimensions (bsc#1084604).
• CVE-2017-13673: Fixed a denial of service in the cpu_physical_memory_snapshot_get_dirty function.
• CVE-2017-13672: Fixed a denial of service via vectors involving display update.

Non-security issues fixed:

• Fixed bad guest time after migration (bsc#1113231).

This update for qemu fixes the following issues:

Security vulnerabilities addressed:

• CVE-2019-6778: Fixed an out-of-bounds access in slirp (bsc#1123156)
• CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493)
• CVE-2018-19489: Fixed a Denial-of-Service in virtfs (bsc#1117275)
• CVE-2018-19364: Fixed an use-after-free vulnerability if virtfs interface is deliberately abused (bsc#1116717)
• CVE-2018-18954: Fixed an out-of-bounds access performing PowerNV memory operations (bsc#1114957)
• CVE-2017-13673: Fixed a reachable assert failure during during display update (bsc#1056386)
• CVE-2017-13672: Fixed an out-of-bounds read access during display update (bsc#1056334)
• CVE-2018-7858: Fixed an out-of-bounds access in cirrus when updating vga display allowing for Denial-of-Service (bsc#1084604)

Other bug fixes and changes:

• Fix pwrite64/pread64/write to return 0 over -1 for a zero length NULL buffer in qemu (bsc#1121600)
• Fix bad guest time after migration (bsc#1113231)

Cyrille Chatras discovered that QEMU incorrectly handled certain PS2 values during migration. An attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS. (CVE-2017-16845)

Cyrille Chatras discovered that QEMU incorrectly handled multiboot. An attacker could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2018-7550)

Ross Lagerwall discovered that QEMU incorrectly handled the Cirrus VGA device. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-7858)