Bug 1486588 (CVE-2017-13673)

Summary: CVE-2017-13673 QEMU: VGA: reachable assert failure during display update
Product: [Other] Security Response Reporter: Prasad J Pandit <ppandit>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: ailan, amit, apevec, areis, ayoung, berrange, bmcclain, cfergeau, chrisw, crobinso, cvsbot-xmlrpc, dblechte, ddepaula, dmoppert, drjones, dwmw2, eedri, imammedo, itamar, jen, jforbes, jjoyce, jschluet, kbasil, knoel, lhh, lpeer, markmc, m.a.young, mburns, mgoldboi, michal.skrivanek, mkenneth, mrezanin, mst, pbonzini, rbryant, rjones, rkrcmar, robinlee.sysu, sbonazzo, sclewis, sherold, slinaber, srevivo, tdecacqu, virt-maint, virt-maint, vkuznets, xen-maint, ykaul
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
An assert failure issue was found in the VGA display emulator built into the Quick emulator (QEMU). It could occur while updating graphics display, due to miscalculating region for dirty bitmap snapshot in split screen mode. A privileged user/process inside guest could use this flaw to crash the QEMU process on the host resulting in denial of service.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:22:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1486589, 1486591, 1486645, 1486646, 1486647, 1486648, 1493359, 1493360, 1493361, 1493362, 1493363, 1493364, 1493365    
Bug Blocks: 1478328, 1520691    

Description Prasad J Pandit 2017-08-30 08:19:26 UTC
Quick emulator(Qemu) built with the VGA display emulator support is vulnerable
to an assert failure issue. It could occur while updating graphics display,
due to miscalculating region for dirty bitmap snapshot in split screen mode.

A privileged user/process inside guest could use this flaw to crash the Qemu
process on the host resulting in DoS.

Upstream patch:
---------------
  -> https://lists.gnu.org/archive/html/qemu-devel/2017-08/msg05333.html

Reference:
----------
  -> http://www.openwall.com/lists/oss-security/2017/08/30/4

Comment 1 Prasad J Pandit 2017-08-30 08:20:07 UTC
Acknowledgments:

Name: David Buchanan

Comment 2 Prasad J Pandit 2017-08-30 08:21:36 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1486591]

Comment 3 Prasad J Pandit 2017-08-30 08:22:01 UTC
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1486589]

Comment 11 Joshua Padman 2017-12-05 04:48:19 UTC
Removing tracker and marking OSP6 as wontfix. RHEL 7.5 is released after OSP6 is EOL.

Comment 19 Doran Moppert 2018-04-04 03:30:24 UTC
removed erroneous rhev-hypervisor tracker that was opened in error and confusing sfm2.

Comment 20 errata-xmlrpc 2018-04-10 18:56:43 UTC
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for RHEL-7

Via RHSA-2018:1104 https://access.redhat.com/errata/RHSA-2018:1104

Comment 21 errata-xmlrpc 2018-04-11 18:03:32 UTC
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)
  Red Hat OpenStack Platform 11.0 (Ocata)
  Red Hat OpenStack Platform 8.0 (Liberty)
  Red Hat OpenStack Platform 9.0 (Mitaka)
  Red Hat OpenStack Platform 12.0 (Pike)

Via RHSA-2018:1113 https://access.redhat.com/errata/RHSA-2018:1113