Security update for kvm SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0929-1 Final 1 1 2012-08-31T14:36:20Z current 2012-08-31T14:36:20Z 2012-08-31T14:36:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for kvm The kvm qemu vt100 emulation was affected by a problem where specific vt100 sequences could have been used by guest users to affect the host. (CVE-2012-3515 aka XSA-17). Also a temp file race was fixed. (CVE-2012-2652) Security Issue reference: * CVE-2012-3515 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515> * CVE-2012-2652 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2652> The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slessp1-kvm Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/ Link for SUSE-SU-2015:0929-1 https://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html E-Mail link for SUSE-SU-2015:0929-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/598271 SUSE Bug 598271 https://bugzilla.suse.com/598298 SUSE Bug 598298 https://bugzilla.suse.com/599095 SUSE Bug 599095 https://bugzilla.suse.com/603161 SUSE Bug 603161 https://bugzilla.suse.com/603179 SUSE Bug 603179 https://bugzilla.suse.com/610682 SUSE Bug 610682 https://bugzilla.suse.com/619991 SUSE Bug 619991 https://bugzilla.suse.com/621793 SUSE Bug 621793 https://bugzilla.suse.com/626654 SUSE Bug 626654 https://bugzilla.suse.com/637297 SUSE Bug 637297 https://bugzilla.suse.com/689895 SUSE Bug 689895 https://bugzilla.suse.com/690781 SUSE Bug 690781 https://bugzilla.suse.com/695510 SUSE Bug 695510 https://bugzilla.suse.com/695766 SUSE Bug 695766 https://bugzilla.suse.com/698237 SUSE Bug 698237 https://bugzilla.suse.com/701161 SUSE Bug 701161 https://bugzilla.suse.com/702823 SUSE Bug 702823 https://bugzilla.suse.com/704933 SUSE Bug 704933 https://bugzilla.suse.com/705095 SUSE Bug 705095 https://bugzilla.suse.com/705304 SUSE Bug 705304 https://bugzilla.suse.com/740165 SUSE Bug 740165 https://bugzilla.suse.com/764526 SUSE Bug 764526 https://bugzilla.suse.com/777084 SUSE Bug 777084 https://bugzilla.suse.com/877642 SUSE Bug 877642 https://bugzilla.suse.com/877645 SUSE Bug 877645 https://bugzilla.suse.com/929339 SUSE Bug 929339 https://bugzilla.suse.com/932770 SUSE Bug 932770 https://www.suse.com/security/cve/CVE-2011-1750/ SUSE CVE CVE-2011-1750 page https://www.suse.com/security/cve/CVE-2011-1751/ SUSE CVE CVE-2011-1751 page https://www.suse.com/security/cve/CVE-2011-2212/ SUSE CVE CVE-2011-2212 page https://www.suse.com/security/cve/CVE-2011-2512/ SUSE CVE CVE-2011-2512 page https://www.suse.com/security/cve/CVE-2011-2527/ SUSE CVE CVE-2011-2527 page https://www.suse.com/security/cve/CVE-2012-0029/ SUSE CVE CVE-2012-0029 page https://www.suse.com/security/cve/CVE-2012-2652/ SUSE CVE CVE-2012-2652 page https://www.suse.com/security/cve/CVE-2012-3515/ SUSE CVE CVE-2012-3515 page https://www.suse.com/security/cve/CVE-2014-0222/ SUSE CVE CVE-2014-0222 page https://www.suse.com/security/cve/CVE-2014-0223/ SUSE CVE CVE-2014-0223 page https://www.suse.com/security/cve/CVE-2015-3209/ SUSE CVE CVE-2015-3209 page https://www.suse.com/security/cve/CVE-2015-3456/ SUSE CVE CVE-2015-3456 page SUSE Linux Enterprise Server 11 SP1-LTSS SUSE Linux Enterprise Server 11 SP1-TERADATA kvm-0.12.5-1.24.1 kvm-0.12.5-1.24.1 as a component of SUSE Linux Enterprise Server 11 SP1-LTSS kvm-0.12.5-1.24.1 as a component of SUSE Linux Enterprise Server 11 SP1-TERADATA Multiple heap-based buffer overflows in the virtio-blk driver (hw/virtio-blk.c) in qemu-kvm 0.14.0 allow local guest users to cause a denial of service (guest crash) and possibly gain privileges via a (1) write request to the virtio_blk_handle_write function or (2) read request to the virtio_blk_handle_read function that is not properly aligned. CVE-2011-1750 SUSE Linux Enterprise Server 11 SP1-LTSS:kvm-0.12.5-1.24.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:kvm-0.12.5-1.24.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/ https://www.suse.com/security/cve/CVE-2011-1750.html CVE-2011-1750 https://bugzilla.suse.com/689895 SUSE Bug 689895 The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers." CVE-2011-1751 SUSE Linux Enterprise Server 11 SP1-LTSS:kvm-0.12.5-1.24.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:kvm-0.12.5-1.24.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/ https://www.suse.com/security/cve/CVE-2011-1751.html CVE-2011-1751 https://bugzilla.suse.com/690781 SUSE Bug 690781 Buffer overflow in the virtio subsystem in qemu-kvm 0.14.0 and earlier allows privileged guest users to cause a denial of service (guest crash) or gain privileges via a crafted indirect descriptor related to "virtqueue in and out requests." CVE-2011-2212 SUSE Linux Enterprise Server 11 SP1-LTSS:kvm-0.12.5-1.24.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:kvm-0.12.5-1.24.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/ https://www.suse.com/security/cve/CVE-2011-2212.html CVE-2011-2212 https://bugzilla.suse.com/701161 SUSE Bug 701161 The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue number, which allows guest users to cause a denial of service (guest crash) and possibly execute arbitrary code via a negative number in the Queue Notify field of the Virtio Header, which bypasses a signed comparison. CVE-2011-2512 SUSE Linux Enterprise Server 11 SP1-LTSS:kvm-0.12.5-1.24.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:kvm-0.12.5-1.24.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/ https://www.suse.com/security/cve/CVE-2011-2512.html CVE-2011-2512 https://bugzilla.suse.com/702823 SUSE Bug 702823 The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host. CVE-2011-2527 SUSE Linux Enterprise Server 11 SP1-LTSS:kvm-0.12.5-1.24.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:kvm-0.12.5-1.24.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/ https://www.suse.com/security/cve/CVE-2011-2527.html CVE-2011-2527 https://bugzilla.suse.com/705304 SUSE Bug 705304 Heap-based buffer overflow in the process_tx_desc function in the e1000 emulation (hw/e1000.c) in qemu-kvm 0.12, and possibly other versions, allows guest OS users to cause a denial of service (QEMU crash) and possibly execute arbitrary code via crafted legacy mode packets. CVE-2012-0029 SUSE Linux Enterprise Server 11 SP1-LTSS:kvm-0.12.5-1.24.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:kvm-0.12.5-1.24.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/ https://www.suse.com/security/cve/CVE-2012-0029.html CVE-2012-0029 https://bugzilla.suse.com/740165 SUSE Bug 740165 https://bugzilla.suse.com/747331 SUSE Bug 747331 https://bugzilla.suse.com/757537 SUSE Bug 757537 The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file. CVE-2012-2652 SUSE Linux Enterprise Server 11 SP1-LTSS:kvm-0.12.5-1.24.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:kvm-0.12.5-1.24.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/ https://www.suse.com/security/cve/CVE-2012-2652.html CVE-2012-2652 https://bugzilla.suse.com/764526 SUSE Bug 764526 Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space." CVE-2012-3515 SUSE Linux Enterprise Server 11 SP1-LTSS:kvm-0.12.5-1.24.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:kvm-0.12.5-1.24.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/ https://www.suse.com/security/cve/CVE-2012-3515.html CVE-2012-3515 https://bugzilla.suse.com/777084 SUSE Bug 777084 Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service (crash) via a large L2 table in a QCOW version 1 image. CVE-2014-0222 SUSE Linux Enterprise Server 11 SP1-LTSS:kvm-0.12.5-1.24.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:kvm-0.12.5-1.24.1 moderate 5.5 AV:A/AC:L/Au:S/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/ https://www.suse.com/security/cve/CVE-2014-0222.html CVE-2014-0222 https://bugzilla.suse.com/1072223 SUSE Bug 1072223 https://bugzilla.suse.com/877642 SUSE Bug 877642 https://bugzilla.suse.com/950367 SUSE Bug 950367 https://bugzilla.suse.com/964925 SUSE Bug 964925 Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a large image size, which triggers a buffer overflow or out-of-bounds read. CVE-2014-0223 SUSE Linux Enterprise Server 11 SP1-LTSS:kvm-0.12.5-1.24.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:kvm-0.12.5-1.24.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/ https://www.suse.com/security/cve/CVE-2014-0223.html CVE-2014-0223 https://bugzilla.suse.com/877645 SUSE Bug 877645 Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set. CVE-2015-3209 SUSE Linux Enterprise Server 11 SP1-LTSS:kvm-0.12.5-1.24.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:kvm-0.12.5-1.24.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/ https://www.suse.com/security/cve/CVE-2015-3209.html CVE-2015-3209 https://bugzilla.suse.com/932267 SUSE Bug 932267 https://bugzilla.suse.com/932770 SUSE Bug 932770 https://bugzilla.suse.com/932823 SUSE Bug 932823 The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM. CVE-2015-3456 SUSE Linux Enterprise Server 11 SP1-LTSS:kvm-0.12.5-1.24.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:kvm-0.12.5-1.24.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150929-1/ https://www.suse.com/security/cve/CVE-2015-3456.html CVE-2015-3456 https://bugzilla.suse.com/929339 SUSE Bug 929339 https://bugzilla.suse.com/932770 SUSE Bug 932770 https://bugzilla.suse.com/935900 SUSE Bug 935900