Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 709490 (CVE-2020-8608) - <app-emulation/qemu-4.2.0-r2: Slirp: potential OOB access due to unsafe snprintf() usages (CVE-2020-8608)
Summary: <app-emulation/qemu-4.2.0-r2: Slirp: potential OOB access due to unsafe snpri...
Status: RESOLVED FIXED
Alias: CVE-2020-8608
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B2 [glsa+ cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2020-02-13 14:36 UTC by Agostino Sarubbo
Modified: 2020-03-30 15:17 UTC (History)
3 users (show)

See Also:
Package list:
app-emulation/qemu-4.2.0-r2
Runtime testing required: ---
stable-bot: sanity-check+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2020-02-13 14:36:44 UTC
From https://www.openwall.com/lists/oss-security/2020/02/06/2 :

   Hello,

A out-of-bounds heap buffer access issue was found in the SLiRP networking 
implementation of the QEMU emulator. It occurs in tcp_emu() routine while 
emulating IRC and other protocols due to unsafe usage of snprintf(3) function.

A user/process could use this flaw to crash the Qemu process on the host 
resulting in DoS or potentially execute arbitrary code with privileges of the 
QEMU process on the host.

Upstream patch:
---------------
   -> https://gitlab.freedesktop.org/slirp/libslirp/commit/68ccb8021a838066f0951d4b2817eb6b6f10a843
   -> https://gitlab.freedesktop.org/slirp/libslirp/commit/68ccb8021a838066f0951d4b2817eb6b6f10a843
   -> https://gitlab.freedesktop.org/slirp/libslirp/commit/30648c03b27fb8d9611b723184216cd3174b6775

This issue was reported by Laszlo Ersek(CC'd) and CVE assigned via -> 
https://cveform.mitre.org/

Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D
Comment 1 Larry the Git Cow gentoo-dev 2020-03-13 18:43:39 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=91b9bba62a5dd73e32bd43434bdaebf8914579ff

commit 91b9bba62a5dd73e32bd43434bdaebf8914579ff
Author:     Matthias Maier <tamiko@gentoo.org>
AuthorDate: 2020-03-13 18:21:03 +0000
Commit:     Matthias Maier <tamiko@gentoo.org>
CommitDate: 2020-03-13 18:22:10 +0000

    app-emulation/qemu: update slirp to current master
    
    Bug: https://bugs.gentoo.org/709490
    Package-Manager: Portage-2.3.93, Repoman-2.3.20
    Signed-off-by: Matthias Maier <tamiko@gentoo.org>

 app-emulation/qemu/Manifest             | 1 +
 app-emulation/qemu/qemu-4.2.0-r2.ebuild | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)
Comment 2 Thomas Deutschmann gentoo-dev Security 2020-03-15 02:13:54 UTC
New GLSA request filed.
Comment 3 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2020-03-15 08:53:38 UTC
amd64 stable
Comment 4 Agostino Sarubbo gentoo-dev 2020-03-15 18:42:46 UTC
x86 stable.

Maintainer(s), please cleanup.
Comment 5 Larry the Git Cow gentoo-dev 2020-03-19 08:15:54 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=df6de6a40066f332b6440ee6b02e68bcb85828bd

commit df6de6a40066f332b6440ee6b02e68bcb85828bd
Author:     Sergei Trofimovich <slyfox@gentoo.org>
AuthorDate: 2020-03-19 08:15:13 +0000
Commit:     Sergei Trofimovich <slyfox@gentoo.org>
CommitDate: 2020-03-19 08:15:47 +0000

    app-emulation/qemu: drop <qemu-4.2.0-r2, bug #709490
    
    Bug: https://bugs.gentoo.org/709490
    Package-Manager: Portage-2.3.94, Repoman-2.3.21
    Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>

 app-emulation/qemu/qemu-4.2.0-r1.ebuild | 829 --------------------------------
 1 file changed, 829 deletions(-)
Comment 6 GLSAMaker/CVETool Bot gentoo-dev 2020-03-30 15:17:24 UTC
This issue was resolved and addressed in
 GLSA 202003-66 at https://security.gentoo.org/glsa/202003-66
by GLSA coordinator Thomas Deutschmann (whissi).