Bug 1296060 (CVE-2016-1714)

Summary:	CVE-2016-1714 Qemu: nvram: OOB r/w access in processing firmware configurations
Product:	[Other] Security Response	Reporter:	Prasad Pandit <ppandit>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	abaron, ailan, amit.shah, aortega, apevec, areis, ayoung, berrange, carnil, cfergeau, chrisw, dallan, drjones, dwmw2, gkotton, imammedo, itamar, jen, jforbes, jschluet, knoel, lhh, lpeer, markmc, m.a.young, mkenneth, mrezanin, mst, pbonzini, rbalakri, rbryant, rjones, rkrcmar, sclewis, slong, tdecacqu, virt-maint, virt-maint, vkuznets, xen-maint, yeylon
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	An out-of-bounds read/write flaw was discovered in the way QEMU's Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-01-28 20:34:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1296080, 1298045, 1298046, 1298047, 1298048, 1298049, 1298050, 1298051, 1298052, 1298385, 1298433, 1298434, 1298435, 1298436
Bug Blocks:	1295739, 1298460

Description Prasad Pandit 2016-01-06 10:03:36 UTC

Qemu emulator built with the Firmware Configuration device emulation support is
vulnerable to an OOB r/w access issue. It could occur while processing firmware
configurations, if the current configuration entry value was set to be
invalid(FW_CFG_INVALID=0xffff).

A privileged(CAP_SYS_RAWIO) user/process inside guest could use this flaw to
crash the Qemu process instance resulting in DoS OR potentially execute
arbitrary code with privileges of the Qemu process on the host.

Upstream fix:
-------------
  -> https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg00428.html

Reference:
----------
  -> http://www.openwall.com/lists/oss-security/2016/01/12/10

Comment 1 Prasad Pandit 2016-01-06 10:07:58 UTC

Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1296080]

Comment 3 Prasad Pandit 2016-01-07 06:44:13 UTC

Acknowledgement:

Red Hat would like to thank Donghai Zhu of Alibaba for reporting this issue.

Comment 9 errata-xmlrpc 2016-01-28 15:41:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:0082 https://rhn.redhat.com/errata/RHSA-2016-0082.html

Comment 10 errata-xmlrpc 2016-01-28 15:42:15 UTC

This issue has been addressed in the following products:

  RHEV-H and Agents for RHEL-6

Via RHSA-2016:0081 https://rhn.redhat.com/errata/RHSA-2016-0081.html

Comment 11 errata-xmlrpc 2016-01-28 15:56:41 UTC

This issue has been addressed in the following products:

  OpenStack 7 For RHEL 7

Via RHSA-2016:0088 https://rhn.redhat.com/errata/RHSA-2016-0088.html

Comment 12 errata-xmlrpc 2016-01-28 15:57:59 UTC

This issue has been addressed in the following products:

  OpenStack 6 for RHEL 7

Via RHSA-2016:0087 https://rhn.redhat.com/errata/RHSA-2016-0087.html

Comment 13 errata-xmlrpc 2016-01-28 15:59:24 UTC

This issue has been addressed in the following products:

  OpenStack 5 for RHEL 7

Via RHSA-2016:0086 https://rhn.redhat.com/errata/RHSA-2016-0086.html

Comment 14 errata-xmlrpc 2016-01-28 16:00:30 UTC

This issue has been addressed in the following products:

  OpenStack 5 for RHEL 6

Via RHSA-2016:0085 https://rhn.redhat.com/errata/RHSA-2016-0085.html

Comment 15 errata-xmlrpc 2016-01-28 16:02:24 UTC

This issue has been addressed in the following products:

  RHEV 3.6 For IBM Power Systems
  RHEV-H and Agents for RHEL-7

Via RHSA-2016:0084 https://rhn.redhat.com/errata/RHSA-2016-0084.html

Comment 16 errata-xmlrpc 2016-01-28 16:14:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:0083 https://rhn.redhat.com/errata/RHSA-2016-0083.html

Comment 17 Fedora Update System 2016-03-19 21:22:02 UTC

xen-4.5.2-9.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 18 Fedora Update System 2016-03-20 02:25:52 UTC

xen-4.5.2-9.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.