Bug 982285 (CVE-2016-5126) - VUL-0: CVE-2016-5126: qemu, kvm: buffer overflow in iscsi_aio_ioctl
Summary: VUL-0: CVE-2016-5126: qemu, kvm: buffer overflow in iscsi_aio_ioctl
Status: RESOLVED FIXED
Alias: CVE-2016-5126
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Bruce Rogers
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/169615/
Whiteboard:
Keywords:
Depends on:
Blocks: 982286
  Show dependency tree / graph
 
Reported: 2016-05-31 07:42 UTC by Alexander Bergmann
Modified: 2017-03-08 16:52 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2016-05-31 07:42:07 UTC 
rh#1340924

Quick Emulator(Qemu) built with the Block driver for iSCSI images support
(virtio-blk) is vulnerable to a heap buffer overflow flaw. It could occur
while processing iSCSI asynchronous I/O ioctl(2) calls.

A user inside guest could use this flaw to crash the Qemu process resulting
in DoS OR potentially leverage it to execute arbitrary code with privileges
of the Qemu process on the host.

Upstream patch:
---------------
  -> https://lists.gnu.org/archive/html/qemu-block/2016-05/msg00779.html

Reference:
----------
  -> http://www.openwall.com/lists/oss-security/2016/05/30/6

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1340924
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5126
http://seclists.org/oss-sec/2016/q2/439
Comment 1 Swamp Workflow Management 2016-05-31 22:00:13 UTC 
bugbot adjusting priority
Comment 2 Swamp Workflow Management 2016-10-21 17:10:22 UTC 
SUSE-SU-2016:2589-1: An update that solves 19 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1000048,967012,967013,982017,982018,982019,982222,982223,982285,982959,983961,983982,991080,991466,994760,994771,994774,996441,997858,997859
CVE References: CVE-2016-2391,CVE-2016-2392,CVE-2016-4453,CVE-2016-4454,CVE-2016-5105,CVE-2016-5106,CVE-2016-5107,CVE-2016-5126,CVE-2016-5238,CVE-2016-5337,CVE-2016-5338,CVE-2016-5403,CVE-2016-6490,CVE-2016-6833,CVE-2016-6836,CVE-2016-6888,CVE-2016-7116,CVE-2016-7155,CVE-2016-7156
Sources used:
SUSE Linux Enterprise Server 12-SP1 (src):    qemu-2.3.1-21.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    qemu-2.3.1-21.1
Comment 3 Swamp Workflow Management 2016-10-25 18:14:43 UTC 
SUSE-SU-2016:2628-1: An update that fixes 16 vulnerabilities is now available.

Category: security (moderate)
Bug References: 902737,944697,967012,967013,982017,982018,982019,982222,982223,982285,982959,983961,983982,991080,991466,996441
CVE References: CVE-2014-7815,CVE-2015-6815,CVE-2016-2391,CVE-2016-2392,CVE-2016-4453,CVE-2016-4454,CVE-2016-5105,CVE-2016-5106,CVE-2016-5107,CVE-2016-5126,CVE-2016-5238,CVE-2016-5337,CVE-2016-5338,CVE-2016-5403,CVE-2016-6490,CVE-2016-7116
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    kvm-1.4.2-47.1
Comment 4 Swamp Workflow Management 2016-10-26 12:13:09 UTC 
openSUSE-SU-2016:2642-1: An update that solves 19 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1000048,967012,967013,982017,982018,982019,982222,982223,982285,982959,983961,983982,991080,991466,994760,994771,994774,996441,997858,997859
CVE References: CVE-2016-2391,CVE-2016-2392,CVE-2016-4453,CVE-2016-4454,CVE-2016-5105,CVE-2016-5106,CVE-2016-5107,CVE-2016-5126,CVE-2016-5238,CVE-2016-5337,CVE-2016-5338,CVE-2016-5403,CVE-2016-6490,CVE-2016-6833,CVE-2016-6836,CVE-2016-6888,CVE-2016-7116,CVE-2016-7155,CVE-2016-7156
Sources used:
openSUSE Leap 42.1 (src):    qemu-2.3.1-19.3, qemu-linux-user-2.3.1-19.1, qemu-testsuite-2.3.1-19.6
Comment 5 Swamp Workflow Management 2016-11-12 07:09:05 UTC 
SUSE-SU-2016:2781-1: An update that fixes 21 vulnerabilities is now available.

Category: security (moderate)
Bug References: 893323,944697,967012,967013,982017,982018,982019,982222,982223,982285,982959,983961,983982,991080,991466,994760,994771,994774,996441,997858,997859
CVE References: CVE-2014-5388,CVE-2015-6815,CVE-2016-2391,CVE-2016-2392,CVE-2016-4453,CVE-2016-4454,CVE-2016-5105,CVE-2016-5106,CVE-2016-5107,CVE-2016-5126,CVE-2016-5238,CVE-2016-5337,CVE-2016-5338,CVE-2016-5403,CVE-2016-6490,CVE-2016-6833,CVE-2016-6836,CVE-2016-6888,CVE-2016-7116,CVE-2016-7155,CVE-2016-7156
Sources used:
SUSE Linux Enterprise Server for SAP 12 (src):    qemu-2.0.2-48.22.1
SUSE Linux Enterprise Server 12-LTSS (src):    qemu-2.0.2-48.22.1
Comment 6 Bruce Rogers 2017-03-08 16:52:21 UTC 
Fixed.