Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 598328 (CVE-2016-9102, CVE-2016-9103, CVE-2016-9104, CVE-2016-9105)

Summary: <app-emulation/qemu-2.7.0-r6: 9pfs: multiple vulnerabilities (CVE-2016-{9102|9103|9104|9105})
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: qemu+disabled
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B2 [glsa cve]
Package list:
Runtime testing required: ---
Bug Depends on: 598772    
Bug Blocks:    

Description Agostino Sarubbo gentoo-dev 2016-10-28 09:52:01 UTC
From http://www.openwall.com/lists/oss-security/2016/10/28/3:

Quick Emulator(Qemu) built with the VirtFS, host directory sharing via Plan 9 
File System(9pfs) support, is vulnerable to a memory leakage issue. It could 
occur when calling v9fs_link call.

A privileged user inside guest could use this flaw to leak the host memory 
bytes resulting in DoS for other services.

Upstream patches:
-----------------
   -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02608.html

Reference:
----------
   -> http://wiki.qemu.org/Documentation/9psetup


From http://www.openwall.com/lists/oss-security/2016/10/28/2:

Quick Emulator(Qemu) built with the VirtFS, host directory sharing via Plan 9 
File System(9pfs) support, is vulnerable to an integer overflow issue. It 
could occur by accessing xattributes values.

A privileged user inside guest could use this flaw to crash the Qemu process 
instance resulting in DoS.

Upstream patch:
---------------
   -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg02942.html

Reference:
----------
   -> http://wiki.qemu.org/Documentation/9psetup



From http://www.openwall.com/lists/oss-security/2016/10/28/1:

Quick Emulator(Qemu) built with the VirtFS, host directory sharing via Plan 9 
File System(9pfs) support, is vulnerable to an information leakage issue. It 
could occur by accessing xattribute value before it's written to.

A privileged user inside guest could use this flaw to leak host memory bytes.

Upstream patch:
---------------
   -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg01790.html

Reference:
----------
   -> http://wiki.qemu.org/Documentation/9psetup



From http://www.openwall.com/lists/oss-security/2016/10/27/15:


Quick Emulator(Qemu) built with the VirtFS, host directory sharing via Plan 9 
File System(9pfs) support, is vulnerable to memory leakage issue. It could 
occur while creating extended attribute via 'Txattrcreate' message.

A privileged user inside guest could use this flaw to leak host memory, thus 
affecting other services on the host and/or potentially crash the Qemu process 
on the host.

Upstream patches:
-----------------
   -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg01861.html

Reference:
----------
   -> http://wiki.qemu.org/Documentation/9psetup
   -> https://bugzilla.redhat.com/show_bug.cgi?id=1389550


All issues was reported by Li Qiang of 360.cn Inc.


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Matthias Maier gentoo-dev 2016-11-12 17:22:34 UTC
Stabilization on bug #598772
Comment 2 GLSAMaker/CVETool Bot gentoo-dev 2016-11-18 23:13:47 UTC
This issue was resolved and addressed in
 GLSA 201611-11 at https://security.gentoo.org/glsa/201611-11
by GLSA coordinator Aaron Bauman (b-man).