Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 731992 - <app-emulation/qemu-5.0.0-r1: Information disclosure in bundled libslirp library (CVE-2020-10756)
Summary: <app-emulation/qemu-5.0.0-r1: Information disclosure in bundled libslirp libr...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B4 [noglsa]
Keywords:
Depends on:
Blocks: bundled-libs CVE-2020-10756
  Show dependency tree
 
Reported: 2020-07-09 21:53 UTC by John Helmert III
Modified: 2020-07-27 20:54 UTC (History)
4 users (show)

See Also:
Package list:
=app-emulation/qemu-5.0.0-r1 amd64 x86
Runtime testing required: ---
nattka: sanity-check+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2020-07-09 21:53:18 UTC
CVE-2020-10756:

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1.
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2020-07-09 21:55:23 UTC
Maintainer, please advise if we are vulnerable.
Comment 2 Sergei Trofimovich (RETIRED) gentoo-dev 2020-07-09 22:49:43 UTC
libslirp upstream fix is https://gitlab.freedesktop.org/slirp/libslirp/-/commit/c7ede54cbd2e2b25385325600958ba0124e31cc0 in src/ip6_input.c

app-emulation/qemu-5.0.0 has no fix yet.
Comment 3 Larry the Git Cow gentoo-dev 2020-07-09 22:55:52 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=55bb42729114274069f2c4d46cfbf7317c58c0f9

commit 55bb42729114274069f2c4d46cfbf7317c58c0f9
Author:     Sergei Trofimovich <slyfox@gentoo.org>
AuthorDate: 2020-07-09 22:55:34 +0000
Commit:     Sergei Trofimovich <slyfox@gentoo.org>
CommitDate: 2020-07-09 22:55:34 +0000

    app-emulation/qemu: backport slirp ipv6 fix: CVE-2020-10756
    
    Reported-by: John Helmert III (ajak)
    Bug: https://bugs.gentoo.org/731992
    Package-Manager: Portage-2.3.103, Repoman-2.3.23
    Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>

 .../qemu-5.0.0-ipv6-slirp-CVE-2020-10756.patch     |  35 +
 app-emulation/qemu/qemu-5.0.0-r1.ebuild            | 838 +++++++++++++++++++++
 2 files changed, 873 insertions(+)
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2020-07-09 23:11:43 UTC
Thanks, please proceed with stabilization when ready.
Comment 5 Sergei Trofimovich (RETIRED) gentoo-dev 2020-07-10 06:52:32 UTC
We can stabilize =app-emulation/qemu-5.0.0-r1
Comment 6 nzjqfqbo 2020-07-11 23:57:45 UTC
Did anyone bump the qemu-9999 package which has the same vuln?
Comment 7 Agostino Sarubbo gentoo-dev 2020-07-17 07:25:22 UTC
amd64 stable
Comment 8 Agostino Sarubbo gentoo-dev 2020-07-17 07:45:55 UTC
x86 stable.

Maintainer(s), please cleanup.
Security, please vote.