Bug 1422656 (CVE-2017-6000)

Summary: REJECTED CVE-2017-6000 Qemu: crypto: memory leakage in qcrypto_ivgen_essiv_init
Product: [Other] Security Response Reporter: Prasad Pandit <ppandit>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: ailan, amit, aortega, apevec, areis, ayoung, berrange, cfergeau, chrisw, cvsbot-xmlrpc, drjones, dwmw2, imammedo, itamar, jen, jjoyce, jschluet, kbasil, knoel, lhh, lpeer, markmc, m.a.young, mkenneth, mrezanin, mst, pbonzini, ppandit, rbalakri, rbryant, rjones, rkrcmar, sclewis, srevivo, tdecacqu, virt-maint, virt-maint, vkuznets, xen-maint
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-02-16 13:02:38 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1422657    
Bug Blocks: 1410057    

Description Prasad Pandit 2017-02-15 18:53:17 UTC 
Quick Emulator(Qemu) built with the Crypto block IV generator - essiv support
is vulnerable to a host memory leakage issue. It could occur while initialising
the crypto device in 'qcrypto_ivgen_essiv_init'.

A guest user/process could use this flaw to leak host memory resulting in DoS.

Upstream patch:
---------------
  -> https://lists.gnu.org/archive/html/qemu-devel/2017-01/msg00295.html

Reference:
----------
  -> http://www.openwall.com/lists/oss-security/2017/02/16/2
Comment 1 Prasad Pandit 2017-02-15 18:53:21 UTC 
Acknowledgments:

Name: Li Qiang (360.cn Inc.)
Comment 2 Prasad Pandit 2017-02-15 18:54:30 UTC 
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1422657]
Comment 3 Daniel Berrangé 2017-02-15 19:10:55 UTC 
(In reply to Prasad J Pandit from comment #0)
> Quick Emulator(Qemu) built with the Crypto block IV generator - essiv support
> is vulnerable to a host memory leakage issue. It could occur while
> initialising
> the crypto device in 'qcrypto_ivgen_essiv_init'.
> 
> A guest user/process could use this flaw to leak host memory resulting in
> DoS.

I don't believe that analysis is correct.

qcrypto_ivgen_essiv_init() is called only from qcrypto_ivgen_new().

qcrypto_ivgen_new() is called only from qcrypto_block_qcow_init() or qcrypto_block_luks_open() or qcrypto_block_luks_create().

None of those three methods can be triggered by guest code.  They are only triggered in response to a host administrator adding a new virtual disk to QEMU.

IOW, you have a leak that only occurs during file open time in the host - it doesn't leak during guest I/O operations.
Comment 4 Daniel Berrangé 2017-02-16 09:24:29 UTC 
FYI I intend to close this NOTABUG unless you can show a scenario in which the guest can trigger this leak.
Comment 5 Prasad Pandit 2017-02-16 13:02:00 UTC 
Hello Dan,

(In reply to Daniel Berrange from comment #3)
> None of those three methods can be triggered by guest code.  They are only
> triggered in response to a host administrator adding a new virtual disk to
> QEMU.
> 
> IOW, you have a leak that only occurs during file open time in the host - it
> doesn't leak during guest I/O operations.

Ah I see, thank you so much for the details. Will close this as non-issue.

Thank you.
Comment 6 Daniel Berrangé 2017-02-16 13:27:49 UTC 
Could you also reply to the quoted oss-security mail to report that this is not in fact a vulnerability in QEMU.