CVE-2020-25707

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• libvirt: double free in qemuAgentGetInterfaces() in qemu_agent.c (CVE-2020-25637)

• QEMU: heap buffer overflow in msix_table_mmio_write() in hw/pci/msix.c (CVE-2020-27821)

• QEMU: ide: atapi: OOB access while processing read commands (CVE-2020-29443)

• QEMU: heap buffer overflow in iscsi_aio_ioctl_cb() in block/iscsi.c may lead to information disclosure (CVE-2020-11947)

• QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c (CVE-2020-16092)

• QEMU: infinite loop in e1000e_write_packet_to_guest() in hw/net/e1000e_core.c (CVE-2020-25707)

• QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c (CVE-2020-25723)

• QEMU: e1000e: infinite loop scenario in case of null packet descriptor (CVE-2020-28916)

• QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets (CVE-2020-29129, CVE-2020-29130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2021-3546: Fix out-of-bounds write in virgl_cmd_get_capset (bsc#1185981)
• CVE-2021-3544: Fix memory leaks found in the virtio vhost-user GPU device (bsc#1186010)
• CVE-2021-3545: Fix information disclosure due to uninitialized memory read (bsc#1185990)
• CVE-2020-25085: Fix out-of-bounds access issue while doing multi block SDMA (bsc#1176681)
• CVE-2020-10756: Fix out-of-bounds read information disclosure in icmp6_send_echoreply(bsc#1172380)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975)

Non-security issues fixed:

• Fix issue where s390 guest fails to find zipl boot menu index (bsc#1183979)
• QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
• Host CPU microcode revision will be visible inside VMs when the proper CPU-model is used (jsc#SLE-17785):
• Fix testsuite error (bsc#1184574)
• Fix qemu crash with iothread when block commit after snapshot (bsc#1187013)
• Fix qemu hang while cancelling migrating hugepage vm (bsc#1185591)
• Use RCU to avoid race during scsi hotplug/hotunplug (bsc#1184574)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for qemu fixes the following issues:

• Switch method of splitting off hw-s390x-virtio-gpu-ccw.so as a module to what was accepted upstream (bsc#1181103)
• Fix OOB access in sdhci interface (CVE-2020-17380, bsc#1175144, CVE-2020-25085, bsc#1176681, CVE-2021-3409, bsc#1182282)
• Fix potential privilege escalation in virtiofsd tool (CVE-2021-20263, bsc#1183373)
• Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)
• Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)
• Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
• QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-3419, bsc#1182975)

This update for kvm fixes the following issues:

• CVE-2021-3594: invalid pointer initialization may lead to information disclosure in slirp (udp) (bsc#1187367)
• CVE-2021-3592: invalid pointer initialization may lead to information disclosure (bootp). (bsc#1187364)
• CVE-2021-3416: infinite loop in loopback mode may lead to stack overflow. (bsc#1186473)
• CVE-2020-15469: MMIO ops null pointer dereference may lead to DoS. (bsc#1173612)
• CVE-2020-11947: iscsi_aio_ioctl_cb in block/iscsi.c has a heap-based buffer over-read. (bsc#1180523)
• CVE-2021-20221: out-of-bound heap buffer access via an interrupt ID field. (bsc#1181933)
• CVE-2020-25707: infinite loop in e1000e_write_packet_to_guest() in hw/net/e1000e_core.c. (bsc#1178683)
• CVE-2020-15863: stack-based overflow in xgmac_enet_send() in hw/net/xgmac.c. (bsc#1174386)

This update for kvm fixes the following issues:

• CVE-2021-3594: invalid pointer initialization may lead to information disclosure in slirp (udp) (bsc#1187367)
• CVE-2021-3592: invalid pointer initialization may lead to information disclosure (bootp). (bsc#1187364)
• CVE-2021-3416: infinite loop in loopback mode may lead to stack overflow. (bsc#1186473)
• CVE-2020-15469: MMIO ops null pointer dereference may lead to DoS. (bsc#1173612)
• CVE-2020-11947: iscsi_aio_ioctl_cb in block/iscsi.c has a heap-based buffer over-read. (bsc#1180523)
• CVE-2021-20221: out-of-bound heap buffer access via an interrupt ID field. (bsc#1181933)
• CVE-2020-25707: infinite loop in e1000e_write_packet_to_guest() in hw/net/e1000e_core.c. (bsc#1178683)
• CVE-2020-15863: stack-based overflow in xgmac_enet_send() in hw/net/xgmac.c. (bsc#1174386)

This update for qemu fixes the following issues:

• Fix out-of-bounds access issue while doing multi block SDMA (CVE-2020-25085, bsc#1176681)
• Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380)
• QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
• Change dependency from CONFIG_VFIO back to CONFIG_LINUX (bsc#1179725)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975)

This update for qemu fixes the following issues:

• CVE-2020-25085: Fix out-of-bounds access issue while doing multi block SDMA (bsc#1176681)
• CVE-2020-10756: Fix out-of-bounds read information disclosure in icmp6_send_echoreply(bsc#1172380)
• Fix issue where s390 guest fails to find zipl boot menu index (bsc#1183979)
• QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
• Host CPU microcode revision will be visible inside VMs when the proper CPU-model is used (jsc#SLE-17785):
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975)

This update for qemu fixes the following issues:

• Fix OOB access during mmio operations (CVE-2020-13754, bsc#1172382)
• Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380)
• Fix out-of-bound heap buffer access via an interrupt ID field (CVE-2021-20221, bsc#1181933)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975, bsc#1094725)

This update for qemu fixes the following issues:

• Fix OOB access during mmio operations (CVE-2020-13754, bsc#1172382)
• Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975)

This update for qemu fixes the following issues:

• CVE-2020-10756: Fix out-of-bounds read information disclosure in icmp6_send_echoreply (bsc#1172380)

This update for qemu fixes the following issues:

• Switch method of splitting off hw-s390x-virtio-gpu-ccw.so as a module to what was accepted upstream (bsc#1181103)
• Fix OOB access in sdhci interface (CVE-2020-17380, bsc#1175144, CVE-2020-25085, bsc#1176681, CVE-2021-3409, bsc#1182282)
• Fix potential privilege escalation in virtiofsd tool (CVE-2021-20263, bsc#1183373)
• Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)
• Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)
• Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
• QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-3419, bsc#1182975)

This update for qemu fixes the following issues:

• Fix OOB access during mmio operations (CVE-2020-13754, bsc#1172382)
• Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380)
• For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975)

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate is a duplicate of CVE-2020-28916