Bug 1179468 (CVE-2020-28916) - VUL-1: CVE-2020-28916: qemu,kvm: e1000e: infinite loop scenario in case of null packet descriptor
Summary: VUL-1: CVE-2020-28916: qemu,kvm: e1000e: infinite loop scenario in case of nu...
Status: RESOLVED FIXED
: CVE-2020-25707 (view as bug list)
Alias: CVE-2020-28916
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Minor
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/272508/
Whiteboard: CVSSv3.1:SUSE:CVE-2020-28916:6.0:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2020-12-01 13:51 UTC by Robert Frohl
Modified: 2024-05-22 14:36 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2020-12-01 13:51:28 UTC 
rh#1903064

An infinite loop issue was found in the e1000e device emulator in QEMU. The issue could occur while receiving packets via e1000e_write_packet_to_guest() routine, if the receive(RX) descriptor has NULL buffer address. A privileged guest user may use this flaw to induce a DoS scenario in the host.

Upstream patch:
---------------
  -> https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg03185.html

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1903064
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28916
http://seclists.org/oss-sec/2020/q4/176
https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg03185.html
Comment 1 Robert Frohl 2020-12-01 17:04:15 UTC 
tracking as affected:

- SUSE:SLE-12-SP5:Update/qemu
- SUSE:SLE-15:Update/qemu
- SUSE:SLE-15-SP1:Update/qemu
- SUSE:SLE-15-SP2:Update/qemu
- SUSE:SLE-15-SP3:Update/qemu
Comment 2 Bruce Rogers 2021-03-21 01:10:32 UTC 
This fix is commit c2cb511634012344e3d0fe49a037a33b12d8a98a, which is in v5.2.0.
Comment 5 Gianluca Gabrielli 2021-04-02 11:21:36 UTC 
*** Bug 1178683 has been marked as a duplicate of this bug. ***
Comment 6 Bruce Rogers 2021-04-07 02:11:58 UTC 
Fixed in maintenance requests for all affected releases. Returning to security team.
Comment 7 Swamp Workflow Management 2021-04-16 16:16:36 UTC 
SUSE-SU-2021:1243-1: An update that solves 15 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1172385,1173612,1176673,1176682,1176684,1178174,1178400,1178934,1179466,1179467,1179468,1179686,1181108,1182425,1182577,1182968,1184064
CVE References: CVE-2020-12829,CVE-2020-15469,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27616,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE MicroOS 5.0 (src):    qemu-4.2.1-11.16.3
SUSE Linux Enterprise Module for Server Applications 15-SP2 (src):    qemu-4.2.1-11.16.3
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    qemu-4.2.1-11.16.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Swamp Workflow Management 2021-04-16 16:19:59 UTC 
SUSE-SU-2021:1245-1: An update that solves 25 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178049,1178174,1178565,1178934,1179466,1179467,1179468,1179686,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968,1183979
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Manager Server 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Manager Retail Branch Server 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Manager Proxy 4.0 (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise Server 15-SP1-BCL (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    qemu-3.1.1.1-9.24.3
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    qemu-3.1.1.1-9.24.3
SUSE Enterprise Storage 6 (src):    qemu-3.1.1.1-9.24.3
SUSE CaaS Platform 4.0 (src):    qemu-3.1.1.1-9.24.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2021-04-16 16:23:19 UTC 
SUSE-SU-2021:1240-1: An update that solves 22 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179467,1179468,1180523,1181108,1181639,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    qemu-2.9.1-6.47.1
SUSE OpenStack Cloud 8 (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    qemu-2.9.1-6.47.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    qemu-2.9.1-6.47.1
HPE Helion Openstack 8 (src):    qemu-2.9.1-6.47.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2021-04-16 16:26:40 UTC 
SUSE-SU-2021:1241-1: An update that solves 24 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1112499,1119115,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    qemu-2.11.2-5.29.1
SUSE OpenStack Cloud 9 (src):    qemu-2.11.2-5.29.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    qemu-2.11.2-5.29.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    qemu-2.11.2-5.29.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2021-04-16 16:30:14 UTC 
SUSE-SU-2021:1244-1: An update that solves 24 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1129962,1154790,1172383,1172384,1172385,1172386,1172478,1173612,1174386,1174641,1175441,1176673,1176682,1176684,1178174,1178565,1178934,1179466,1179467,1179468,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13361,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-14364,CVE-2020-15469,CVE-2020-15863,CVE-2020-16092,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise Server 15-LTSS (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    qemu-2.11.2-9.43.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    qemu-2.11.2-9.43.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2021-04-16 16:36:44 UTC 
SUSE-SU-2021:1242-1: An update that solves 21 vulnerabilities and has 5 fixes is now available.

Category: security (important)
Bug References: 1172383,1172385,1172386,1172478,1173612,1176673,1176682,1176684,1178049,1178174,1178934,1179466,1179467,1179468,1179686,1179725,1179726,1180523,1181108,1181639,1181933,1182137,1182425,1182577,1182968,1183979
CVE References: CVE-2020-11947,CVE-2020-12829,CVE-2020-13362,CVE-2020-13659,CVE-2020-13765,CVE-2020-15469,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20181,CVE-2021-20203,CVE-2021-20221,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    qemu-3.1.1.1-48.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2021-04-23 16:25:57 UTC 
openSUSE-SU-2021:0600-1: An update that solves 15 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1172385,1173612,1176673,1176682,1176684,1178174,1178400,1178934,1179466,1179467,1179468,1179686,1181108,1182425,1182577,1182968,1184064
CVE References: CVE-2020-12829,CVE-2020-15469,CVE-2020-25084,CVE-2020-25624,CVE-2020-25625,CVE-2020-25723,CVE-2020-27616,CVE-2020-27617,CVE-2020-27821,CVE-2020-28916,CVE-2020-29129,CVE-2020-29130,CVE-2020-29443,CVE-2021-20257,CVE-2021-3416
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    qemu-4.2.1-lp152.9.12.1, qemu-linux-user-4.2.1-lp152.9.12.1, qemu-testsuite-4.2.1-lp152.9.12.1
Comment 18 Andrea Mattiazzo 2024-05-22 14:36:12 UTC 
All done, closing.