Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 686026 - <app-emulation/qemu-4.0.0-r3: multiple vulnerabilities (ZombieLoad)
Summary: <app-emulation/qemu-4.0.0-r3: multiple vulnerabilities (ZombieLoad)
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [noglsa]
Keywords:
Depends on:
Blocks: CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091, ZombieLoad
  Show dependency tree
 
Reported: 2019-05-15 12:52 UTC by GLSAMaker/CVETool Bot
Modified: 2019-08-03 15:19 UTC (History)
2 users (show)

See Also:
Package list:
app-emulation/qemu-4.0.0-r3 app-emulation/libvirt-5.2.0-r2 dev-python/libvirt-python-5.2.0 net-firewall/firewalld-0.6.3 sys-apps/dtc-1.5.0
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2019-05-15 12:52:52 UTC 
See tracker bug for more information.
Comment 1 Larry the Git Cow gentoo-dev 2019-05-17 07:43:05 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=da85259a7360cc838131956376a857bf245ab974

commit da85259a7360cc838131956376a857bf245ab974
Author:     Matthias Maier <tamiko@gentoo.org>
AuthorDate: 2019-05-17 07:30:27 +0000
Commit:     Matthias Maier <tamiko@gentoo.org>
CommitDate: 2019-05-17 07:30:27 +0000

    app-emulation/qemu: mds fixes for 4.0.0
    
    CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091, ZombieLoad
    
    Bug: https://bugs.gentoo.org/686026
    Package-Manager: Portage-2.3.66, Repoman-2.3.12
    Signed-off-by: Matthias Maier <tamiko@gentoo.org>

 app-emulation/qemu/{qemu-4.0.0.ebuild => qemu-4.0.0-r1.ebuild} | 1 +
 1 file changed, 1 insertion(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9f4c389d721da9d13eae97c36040bea25eddc367

commit 9f4c389d721da9d13eae97c36040bea25eddc367
Author:     Matthias Maier <tamiko@gentoo.org>
AuthorDate: 2019-05-17 07:28:50 +0000
Commit:     Matthias Maier <tamiko@gentoo.org>
CommitDate: 2019-05-17 07:28:50 +0000

    app-emulation/qemu: mds fixes for 3.1.0
    
    CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091, ZombieLoad
    
    Bug: https://bugs.gentoo.org/686026
    Package-Manager: Portage-2.3.66, Repoman-2.3.12
    Signed-off-by: Matthias Maier <tamiko@gentoo.org>

 .../qemu/files/qemu-3.1.0-md-clear-md-no.patch     |  38 +
 app-emulation/qemu/qemu-3.1.0-r5.ebuild            | 815 +++++++++++++++++++++
 2 files changed, 853 insertions(+)
Comment 2 Matthias Maier gentoo-dev 2019-05-17 08:29:27 UTC 
The currently applied patches (3.1.0-r5, 4.0.0-r1) do not lead to a successful mitigation in the guest. I will wait for upstream to officially push the corresponding changes to their development repository.
Comment 3 Larry the Git Cow gentoo-dev 2019-05-19 23:42:27 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=24b89b257a1443febe97c8981ff8537f21e8db02

commit 24b89b257a1443febe97c8981ff8537f21e8db02
Author:     Matthias Maier <tamiko@gentoo.org>
AuthorDate: 2019-05-19 22:07:45 +0000
Commit:     Matthias Maier <tamiko@gentoo.org>
CommitDate: 2019-05-19 23:42:11 +0000

    app-emulation/libvirt: add support for md-clear
    
    Bug: https://bugs.gentoo.org/686026
    Package-Manager: Portage-2.3.66, Repoman-2.3.12
    Signed-off-by: Matthias Maier <tamiko@gentoo.org>

 .../libvirt/files/libvirt-5.2.0-md-clear.patch     | 36 ++++++++++++++++++++++
 ...irt-5.2.0-r1.ebuild => libvirt-5.2.0-r2.ebuild} |  1 +
 2 files changed, 37 insertions(+)
Comment 4 Matthias Maier gentoo-dev 2019-05-19 23:46:12 UTC 
Arches, please stabilize!
Comment 5 Stabilization helper bot gentoo-dev 2019-05-20 00:00:26 UTC 
An automated check of this bug failed - the following atom is unknown:

app-emulation/libvirt-5.2.0-r1

Please verify the atom list.
Comment 6 Stabilization helper bot gentoo-dev 2019-05-20 01:02:23 UTC 
An automated check of this bug failed - repoman reported dependency errors (138 lines truncated): 

> dependency.bad app-emulation/qemu/qemu-4.0.0-r3.ebuild: DEPEND: amd64(default/linux/amd64/17.0) ['>=sys-apps/dtc-1.5.0']
> dependency.bad app-emulation/qemu/qemu-4.0.0-r3.ebuild: RDEPEND: amd64(default/linux/amd64/17.0) ['>=sys-apps/dtc-1.5.0']
> dependency.bad app-emulation/qemu/qemu-4.0.0-r3.ebuild: DEPEND: amd64(default/linux/amd64/17.0/desktop) ['>=sys-apps/dtc-1.5.0']
> dependency.bad app-emulation/libvirt/libvirt-5.2.0-r2.ebuild: DEPEND: amd64(default/linux/amd64/17.0) ['>=net-firewall/firewalld-0.6.3']
> dependency.bad app-emulation/libvirt/libvirt-5.2.0-r2.ebuild: RDEPEND: amd64(default/linux/amd64/17.0) ['>=net-firewall/firewalld-0.6.3']
> dependency.bad app-emulation/libvirt/libvirt-5.2.0-r2.ebuild: DEPEND: amd64(default/linux/amd64/17.0/desktop) ['>=net-firewall/firewalld-0.6.3']
Comment 7 Stabilization helper bot gentoo-dev 2019-05-20 02:02:17 UTC 
An automated check of this bug succeeded - the previous repoman errors are now resolved.
Comment 8 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2019-05-20 11:07:05 UTC 
amd64 stable
Comment 9 Thomas Deutschmann (RETIRED) gentoo-dev 2019-05-26 22:30:07 UTC 
x86 stable
Comment 10 Larry the Git Cow gentoo-dev 2019-07-02 21:10:36 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6344f3b8e85bf46743f6e2c74a698f6297fa369e

commit 6344f3b8e85bf46743f6e2c74a698f6297fa369e
Author:     Matthias Maier <tamiko@gentoo.org>
AuthorDate: 2019-07-02 21:10:06 +0000
Commit:     Matthias Maier <tamiko@gentoo.org>
CommitDate: 2019-07-02 21:10:06 +0000

    app-emulation/qemu: drop vulnerable
    
    Bug: https://bugs.gentoo.org/686026
    Package-Manager: Portage-2.3.68, Repoman-2.3.16
    Signed-off-by: Matthias Maier <tamiko@gentoo.org>

 app-emulation/qemu/Manifest             |   2 -
 app-emulation/qemu/qemu-3.1.0-r4.ebuild | 813 --------------------------------
 2 files changed, 815 deletions(-)
Comment 11 Matthias Maier gentoo-dev 2019-07-02 21:11:22 UTC 
Security, *ping*
Comment 12 Matthias Maier gentoo-dev 2019-07-28 17:47:29 UTC 
*ping* Security