Security update for qemu

Announcement ID:	SUSE-SU-2017:0127-1
Rating:	important
References:	bsc#1007454 bsc#1008519 bsc#1009109 bsc#1013285 bsc#1013341 bsc#1013764 bsc#1013767 bsc#1014109 bsc#1014110 bsc#1014111 bsc#1014112 bsc#1014256 bsc#1014514 bsc#1016779 bsc#937125
Cross-References:	CVE-2016-9102 CVE-2016-9103 CVE-2016-9381 CVE-2016-9776 CVE-2016-9845 CVE-2016-9846 CVE-2016-9907 CVE-2016-9908 CVE-2016-9911 CVE-2016-9912 CVE-2016-9913 CVE-2016-9921 CVE-2016-9922
CVSS scores:	CVE-2016-9102 ( NVD ): 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2016-9102 ( NVD ): 6.0 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2016-9103 ( NVD ): 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N CVE-2016-9103 ( NVD ): 6.0 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N CVE-2016-9381 ( SUSE ): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2016-9381 ( NVD ): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2016-9381 ( NVD ): 7.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2016-9776 ( SUSE ): 3.0 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L CVE-2016-9776 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2016-9776 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2016-9845 ( NVD ): 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2016-9846 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2016-9846 ( NVD ): 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2016-9907 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2016-9907 ( NVD ): 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2016-9908 ( NVD ): 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2016-9911 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2016-9911 ( NVD ): 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2016-9912 ( NVD ): 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2016-9913 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2016-9913 ( NVD ): 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2016-9921 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2016-9921 ( NVD ): 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2016-9922 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2016-9922 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products:	SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2

An update that solves 13 vulnerabilities and has two security fixes can now be installed.

Description:

qemu was updated to fix several issues.

These security issues were fixed:

• CVE-2016-9102: Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number (bsc#1014256).
• CVE-2016-9103: The v9fs_xattrcreate function in hw/9pfs/9p.c in allowed local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values writing to them (bsc#1007454).
• CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109)
• CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013285).
• CVE-2016-9845: The Virtio GPU Device emulator support as vulnerable to an information leakage issue while processing the 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could have used this flaw to leak contents of the host memory (bsc#1013767).
• CVE-2016-9846: The Virtio GPU Device emulator support was vulnerable to a memory leakage issue while updating the cursor data in update_cursor_data_virgl. A guest user/process could have used this flaw to leak host memory bytes, resulting in DoS for the host (bsc#1013764).
• CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014109).
• CVE-2016-9908: The Virtio GPU Device emulator support was vulnerable to an information leakage issue while processing the 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could have used this flaw to leak contents of the host memory (bsc#1014514).
• CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014111).
• CVE-2016-9912: The Virtio GPU Device emulator support was vulnerable to a memory leakage issue while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could have used this flaw to leak host memory bytes, resulting in DoS for the host (bsc#1014112).
• CVE-2016-9913: VirtFS was vulnerable to memory leakage issue via its '9p-handle' or '9p-proxy' backend drivers. A privileged user inside guest could have used this flaw to leak host memory, thus affecting other services on the host and/or potentially crash the Qemu process on the host (bsc#1014110).

These non-security issues were fixed:

• Fixed uint64 property parsing and add regression tests (bsc#937125)
• Added a man page for kvm_stat
• Fix crash in vte (bsc#1008519)
• Various upstream commits targeted towards stable releases (bsc#1013341)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Desktop 12 SP2
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-68=1
• SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2
  zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-68=1
• SUSE Linux Enterprise High Performance Computing 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-68=1
• SUSE Linux Enterprise Server 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-68=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-68=1

Package List:

• SUSE Linux Enterprise Desktop 12 SP2 (x86_64)
  • qemu-2.6.2-39.1
  • qemu-block-curl-2.6.2-39.1
  • qemu-tools-2.6.2-39.1
  • qemu-x86-2.6.2-39.1
  • qemu-tools-debuginfo-2.6.2-39.1
  • qemu-debugsource-2.6.2-39.1
  • qemu-block-curl-debuginfo-2.6.2-39.1
  • qemu-kvm-2.6.2-39.1
• SUSE Linux Enterprise Desktop 12 SP2 (noarch)
  • qemu-vgabios-1.9.1-39.1
  • qemu-ipxe-1.0.0-39.1
  • qemu-sgabios-8-39.1
  • qemu-seabios-1.9.1-39.1
• SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2 (aarch64)
  • qemu-2.6.2-39.1
  • qemu-arm-debuginfo-2.6.2-39.1
  • qemu-block-curl-2.6.2-39.1
  • qemu-arm-2.6.2-39.1
  • qemu-guest-agent-2.6.2-39.1
  • qemu-tools-2.6.2-39.1
  • qemu-block-ssh-debuginfo-2.6.2-39.1
  • qemu-lang-2.6.2-39.1
  • qemu-block-rbd-debuginfo-2.6.2-39.1
  • qemu-debugsource-2.6.2-39.1
  • qemu-guest-agent-debuginfo-2.6.2-39.1
  • qemu-tools-debuginfo-2.6.2-39.1
  • qemu-block-ssh-2.6.2-39.1
  • qemu-block-curl-debuginfo-2.6.2-39.1
  • qemu-block-rbd-2.6.2-39.1
• SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2 (noarch)
  • qemu-ipxe-1.0.0-39.1
• SUSE Linux Enterprise High Performance Computing 12 SP2 (aarch64 x86_64)
  • qemu-2.6.2-39.1
  • qemu-block-curl-2.6.2-39.1
  • qemu-guest-agent-2.6.2-39.1
  • qemu-tools-2.6.2-39.1
  • qemu-block-ssh-debuginfo-2.6.2-39.1
  • qemu-lang-2.6.2-39.1
  • qemu-block-rbd-debuginfo-2.6.2-39.1
  • qemu-debugsource-2.6.2-39.1
  • qemu-guest-agent-debuginfo-2.6.2-39.1
  • qemu-tools-debuginfo-2.6.2-39.1
  • qemu-block-ssh-2.6.2-39.1
  • qemu-block-curl-debuginfo-2.6.2-39.1
  • qemu-block-rbd-2.6.2-39.1
• SUSE Linux Enterprise High Performance Computing 12 SP2 (aarch64)
  • qemu-arm-debuginfo-2.6.2-39.1
  • qemu-arm-2.6.2-39.1
• SUSE Linux Enterprise High Performance Computing 12 SP2 (noarch)
  • qemu-vgabios-1.9.1-39.1
  • qemu-ipxe-1.0.0-39.1
  • qemu-sgabios-8-39.1
  • qemu-seabios-1.9.1-39.1
• SUSE Linux Enterprise High Performance Computing 12 SP2 (x86_64)
  • qemu-kvm-2.6.2-39.1
  • qemu-x86-2.6.2-39.1
• SUSE Linux Enterprise Server 12 SP2 (aarch64 ppc64le s390x x86_64)
  • qemu-2.6.2-39.1
  • qemu-block-curl-2.6.2-39.1
  • qemu-guest-agent-2.6.2-39.1
  • qemu-tools-2.6.2-39.1
  • qemu-block-ssh-debuginfo-2.6.2-39.1
  • qemu-lang-2.6.2-39.1
  • qemu-debugsource-2.6.2-39.1
  • qemu-guest-agent-debuginfo-2.6.2-39.1
  • qemu-tools-debuginfo-2.6.2-39.1
  • qemu-block-ssh-2.6.2-39.1
  • qemu-block-curl-debuginfo-2.6.2-39.1
• SUSE Linux Enterprise Server 12 SP2 (aarch64)
  • qemu-arm-debuginfo-2.6.2-39.1
  • qemu-arm-2.6.2-39.1
• SUSE Linux Enterprise Server 12 SP2 (aarch64 x86_64)
  • qemu-block-rbd-debuginfo-2.6.2-39.1
  • qemu-block-rbd-2.6.2-39.1
• SUSE Linux Enterprise Server 12 SP2 (noarch)
  • qemu-vgabios-1.9.1-39.1
  • qemu-ipxe-1.0.0-39.1
  • qemu-sgabios-8-39.1
  • qemu-seabios-1.9.1-39.1
• SUSE Linux Enterprise Server 12 SP2 (ppc64le)
  • qemu-ppc-debuginfo-2.6.2-39.1
  • qemu-ppc-2.6.2-39.1
• SUSE Linux Enterprise Server 12 SP2 (s390x x86_64)
  • qemu-kvm-2.6.2-39.1
• SUSE Linux Enterprise Server 12 SP2 (s390x)
  • qemu-s390-2.6.2-39.1
  • qemu-s390-debuginfo-2.6.2-39.1
• SUSE Linux Enterprise Server 12 SP2 (x86_64)
  • qemu-x86-2.6.2-39.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2 (ppc64le x86_64)
  • qemu-2.6.2-39.1
  • qemu-block-curl-2.6.2-39.1
  • qemu-guest-agent-2.6.2-39.1
  • qemu-tools-2.6.2-39.1
  • qemu-block-ssh-debuginfo-2.6.2-39.1
  • qemu-lang-2.6.2-39.1
  • qemu-debugsource-2.6.2-39.1
  • qemu-guest-agent-debuginfo-2.6.2-39.1
  • qemu-tools-debuginfo-2.6.2-39.1
  • qemu-block-ssh-2.6.2-39.1
  • qemu-block-curl-debuginfo-2.6.2-39.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2 (ppc64le)
  • qemu-ppc-debuginfo-2.6.2-39.1
  • qemu-ppc-2.6.2-39.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2 (x86_64)
  • qemu-block-rbd-debuginfo-2.6.2-39.1
  • qemu-x86-2.6.2-39.1
  • qemu-kvm-2.6.2-39.1
  • qemu-block-rbd-2.6.2-39.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2 (noarch)
  • qemu-vgabios-1.9.1-39.1
  • qemu-ipxe-1.0.0-39.1
  • qemu-sgabios-8-39.1
  • qemu-seabios-1.9.1-39.1

References:

• https://www.suse.com/security/cve/CVE-2016-9102.html
• https://www.suse.com/security/cve/CVE-2016-9103.html
• https://www.suse.com/security/cve/CVE-2016-9381.html
• https://www.suse.com/security/cve/CVE-2016-9776.html
• https://www.suse.com/security/cve/CVE-2016-9845.html
• https://www.suse.com/security/cve/CVE-2016-9846.html
• https://www.suse.com/security/cve/CVE-2016-9907.html
• https://www.suse.com/security/cve/CVE-2016-9908.html
• https://www.suse.com/security/cve/CVE-2016-9911.html
• https://www.suse.com/security/cve/CVE-2016-9912.html
• https://www.suse.com/security/cve/CVE-2016-9913.html
• https://www.suse.com/security/cve/CVE-2016-9921.html
• https://www.suse.com/security/cve/CVE-2016-9922.html
• https://bugzilla.suse.com/show_bug.cgi?id=1007454
• https://bugzilla.suse.com/show_bug.cgi?id=1008519
• https://bugzilla.suse.com/show_bug.cgi?id=1009109
• https://bugzilla.suse.com/show_bug.cgi?id=1013285
• https://bugzilla.suse.com/show_bug.cgi?id=1013341
• https://bugzilla.suse.com/show_bug.cgi?id=1013764
• https://bugzilla.suse.com/show_bug.cgi?id=1013767
• https://bugzilla.suse.com/show_bug.cgi?id=1014109
• https://bugzilla.suse.com/show_bug.cgi?id=1014110
• https://bugzilla.suse.com/show_bug.cgi?id=1014111
• https://bugzilla.suse.com/show_bug.cgi?id=1014112
• https://bugzilla.suse.com/show_bug.cgi?id=1014256
• https://bugzilla.suse.com/show_bug.cgi?id=1014514
• https://bugzilla.suse.com/show_bug.cgi?id=1016779
• https://bugzilla.suse.com/show_bug.cgi?id=937125