Bug 889301 (CVE-2012-6075)

Summary: CVE-2012-6075 qemu: e1000 driver buffer overflow when processing large packets when SBP and LPE flags are disabled
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: amit.shah, berrange, bfan, cfergeau, dwmw2, itamar, jasowang, jforbes, juzhang, kraxel, leiwang, lkundrak, m.a.young, moli, mst, pbonzini, pmatouse, qguan, rhod, rjones, scottt.tw, vyasevic, wshi
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=important,public=20121216,reported=20121216,source=debian,cvss2=6.8/AV:A/AC:H/Au:N/C:C/I:C/A:C,fedora-all/qemu=affected,epel-5/qemu=affected,fedora-17/qemu=affected,rhel-5/kvm=affected,rhel-6/qemu-kvm=affected,rhel-5/xen=affected,fedora-all/xen=affected,openstack-2.1/qemu-kvm-rhev=affected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-04-24 03:39:49 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 889305, 889304, 910839, 910840, 910841, 910842, 910843, 910844, 910845, 918288    
Bug Blocks: 890969, 912639, 916344, 916610, 918294    

Description Jan Lieskovsky 2012-12-20 13:07:58 EST
A buffer overflow flaw was found in the way e1000 emulated device driver of QEMU, a FAST! processor emulator, processed received large e1000 packets, when the SBP and LPE flags were disabled. If the underlying network was configured to allow large (jumbo) packets, a remote attacker could use this flaw to cause relevant guest in question to crash (DoS) or, potentially, the attacker could use this flaw to execute arbitrary code on the guest system with the kernel level privilege.

References:
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=696051
[2] http://www.openwall.com/lists/oss-security/2012/12/19/9
[3] http://thread.gmane.org/gmane.comp.emulators.qemu/182666
[4] http://www.openwall.com/lists/oss-security/2013/01/17/12

Relevant upstream patches:
[5] http://git.qemu.org/?p=qemu.git;a=commitdiff;h=b0d9ffcd0251161c7c92f94804dcf599dfa3edeb
    http://git.qemu.org/?p=qemu.git;a=commitdiff;h=2c0331f4f7d241995452b99afaf0aab00493334a
Comment 1 Jan Lieskovsky 2012-12-20 13:13:19 EST
This issue affects the versions of the qemu package, as shipped with Fedora release of 16 and 17. Please schedule an update.

--

This issue (probably [*]) affects the version of the qemu package, as shipped with Fedora EPEL 5. Please schedule an update.

[*] Saying probably above, since in Fedora EPEL 5 version e1000_receive() routine is declared as returning void in comparison with more recent versions. Therefore not definitely sure the deficiency would be present on this version too. Needs further investigation by someone more familiar with the code. P.S.: Feel free to close the upcoming epel-5 bug (if you realise this isn't an issue for Fedora EPEL 5 version). Thank you, Jan.
Comment 2 Jan Lieskovsky 2012-12-20 13:14:28 EST
Created qemu tracking bugs for this issue

Affects: fedora-all [bug 889304]
Affects: epel-5 [bug 889305]
Comment 3 Jan Lieskovsky 2013-01-02 04:44:08 EST
The CVE identifier of CVE-2012-6075 has been assigned to this issue:
  http://www.openwall.com/lists/oss-security/2012/12/30/1
Comment 4 Fedora Update System 2013-01-26 10:56:07 EST
qemu-1.0.1-3.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2013-01-26 11:03:16 EST
qemu-1.2.2-2.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2013-01-28 10:19:46 EST
qemu-0.15.1-9.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Petr Matousek 2013-02-13 11:57:03 EST
Created xen tracking bugs for this issue

Affects: fedora-all [bug 910845]
Comment 11 Petr Matousek 2013-02-13 12:12:26 EST
Statement:

(none)
Comment 18 errata-xmlrpc 2013-03-06 13:49:23 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2013:0599 https://rhn.redhat.com/errata/RHSA-2013-0599.html
Comment 19 errata-xmlrpc 2013-03-07 13:45:36 EST
This issue has been addressed in following products:

  RHEV-H and Agents for RHEL-6

Via RHSA-2013:0610 https://rhn.redhat.com/errata/RHSA-2013-0610.html
Comment 20 errata-xmlrpc 2013-03-07 13:45:49 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2013:0608 https://rhn.redhat.com/errata/RHSA-2013-0608.html
Comment 21 errata-xmlrpc 2013-03-07 14:00:22 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0609 https://rhn.redhat.com/errata/RHSA-2013-0609.html
Comment 22 errata-xmlrpc 2013-03-12 13:58:39 EDT
This issue has been addressed in following products:

  OpenStack Folsom for RHEL 6

Via RHSA-2013:0639 https://rhn.redhat.com/errata/RHSA-2013-0639.html
Comment 23 errata-xmlrpc 2013-03-13 10:47:38 EDT
This issue has been addressed in following products:

  RHEV-H and Agents for RHEL-6

Via RHSA-2013:0636 https://rhn.redhat.com/errata/RHSA-2013-0636.html