Bug 1444371 (CVE-2017-7980)

Summary:	CVE-2017-7980 Qemu: display: cirrus: OOB r/w access issues in bitblt routines
Product:	[Other] Security Response	Reporter:	Prasad Pandit <ppandit>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ailan, amit, apevec, areis, berrange, cfergeau, chrisw, cvsbot-xmlrpc, ddepaula, drjones, dwmw2, gmollett, imammedo, itamar, jen, jjoyce, jschluet, kbasil, knoel, lhh, lpeer, markmc, m.a.young, mkenneth, mrezanin, mst, pbonzini, rbryant, rjones, rkrcmar, robinlee.sysu, sclewis, slong, srevivo, tdecacqu, virt-maint, virt-maint, vkuznets, xen-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	An out-of-bounds r/w access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data via various bitblt functions. A privileged user inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:10:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1444372, 1444373, 1444377, 1444378, 1444379, 1444380, 1444382, 1444383, 1444384, 1444385, 1444387, 1444388, 1444390, 1444391, 1444392, 1444393, 1444394, 1445559
Bug Blocks:	1432498

Description Prasad Pandit 2017-04-21 08:59:32 UTC

Quick emulator(Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is
vulnerable to an out-of-bounds r/w access issues. It could occur while copying
VGA data via various bitblt functions.

A privileged user inside guest could use this flaw to crash the Qemu process
resulting in DoS OR potentially execute arbitrary code on a host with
privileges of Qemu process on the host.

Upstream patches:
-----------------
  -> http://git.qemu.org/?p=qemu.git;a=commitdiff;h=026aeffcb4752054830ba203020ed6eb05bcaba8
  -> http://git.qemu.org/?p=qemu.git;a=commitdiff;h=ffaf857778286ca54e3804432a2369a279e73aa7

Reference:
----------
  -> http://www.openwall.com/lists/oss-security/2017/04/21/1

Comment 1 Prasad Pandit 2017-04-21 09:00:09 UTC

Acknowledgments:

Name: Jiangxin (PSIRT Huawei Inc.), Li Qiang (Qihoo 360 Gear Team)

Comment 2 Prasad Pandit 2017-04-21 09:02:18 UTC

Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1444373]

Comment 3 Prasad Pandit 2017-04-21 09:02:41 UTC

Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1444372]

Comment 9 errata-xmlrpc 2017-05-09 11:09:17 UTC

This issue has been addressed in the following products:

  RHEV 3.X Hypervisor and Agents for RHEL-6

Via RHSA-2017:1205 https://access.redhat.com/errata/RHSA-2017:1205

Comment 10 errata-xmlrpc 2017-05-09 12:48:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:1206 https://access.redhat.com/errata/RHSA-2017:1206

Comment 19 errata-xmlrpc 2017-06-13 07:27:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1430 https://access.redhat.com/errata/RHSA-2017:1430

Comment 20 errata-xmlrpc 2017-06-14 15:35:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6

Via RHSA-2017:1441 https://access.redhat.com/errata/RHSA-2017:1441

Comment 21 Fedora Update System 2017-07-25 21:24:47 UTC

qemu-2.7.1-7.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.