Bug 733448 – app-emulation/qemu: Use-after-free in hw/net/e1000e_core.c (CVE-2020-{15863,15859})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2020-07-21 17:43:45 UTC]

CVE-2020-15859:

QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.



Reporting because I'm not confident about the accuracy of the version in the CVE description. Maintainers, please confirm if we are vulnerable and if so create a patched version. There is a patch on qemu-devel:

https://lists.gnu.org/archive/html/qemu-devel/2020-07/msg05895.html

[Comment 1 Sergei Trofimovich (RETIRED) 2020-07-21 18:28:14 UTC]

5.0 is probably affected as well. Given that it's a very delicate piece of NIC's MMIO emulation we'll wait on fix to land upstream.

[Comment 2 John Helmert III 2020-07-28 19:58:45 UTC]

(In reply to John Helmert III (ajak) from comment #0)
> CVE-2020-15859:
> 
> QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS
> user can trigger an e1000e packet with the data's address set to the
> e1000e's MMIO address.
> 
> 
> 
> Reporting because I'm not confident about the accuracy of the version in the
> CVE description. Maintainers, please confirm if we are vulnerable and if so
> create a patched version. There is a patch on qemu-devel:
> 
> https://lists.gnu.org/archive/html/qemu-devel/2020-07/msg05895.html

No patch for this yet as far as I can tell, but we have another vulnerability that is patched for 5.1.0-rc1.

CVE-2020-15863:

hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential privileged code execution. This was fixed in commit 5519724a13664b43e225ca05351c60b4468e4555.

Patch: https://git.qemu.org/?p=qemu.git;a=commitdiff;h=5519724a13664b43e225ca05351c60b4468e4555

qemu $ git tag --contains 5519724a13664b43e225ca05351c60b4468e4555
v5.1.0-rc1

[Comment 3 John Helmert III 2020-08-19 19:12:58 UTC]

(In reply to John Helmert III (ajak) from comment #2)
> (In reply to John Helmert III (ajak) from comment #0)
> > CVE-2020-15859:
> > 
> > QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS
> > user can trigger an e1000e packet with the data's address set to the
> > e1000e's MMIO address.
> > 
> > 
> > 
> > Reporting because I'm not confident about the accuracy of the version in the
> > CVE description. Maintainers, please confirm if we are vulnerable and if so
> > create a patched version. There is a patch on qemu-devel:
> > 
> > https://lists.gnu.org/archive/html/qemu-devel/2020-07/msg05895.html

I would be surprised if this is still unfixed, but I can't find where/if it made its way into git.

[Comment 4 Sergei Trofimovich (RETIRED) 2020-08-19 20:57:25 UTC]

Upstream bug report is still open.

[Comment 5 Matthias Maier 2021-04-04 19:23:36 UTC]

This has still not been resolved upstream.

[Comment 6 John Helmert III 2021-06-21 16:24:50 UTC]

Fixed "a few months ago" according to upstream, not sure about fixed versions...

[Comment 7 John Helmert III 2022-08-14 02:52:58 UTC]

(In reply to John Helmert III from comment #6)
> Fixed "a few months ago" according to upstream, not sure about fixed
> versions...

... and since qemu is so big, I can't bisect without hitting a different build failure with every version. We need to GLSA qemu-7.0.0 anyway, so I don't think it matters much if we can't narrow down the fixed version for this.

[Comment 8 John Helmert III 2022-08-14 04:41:45 UTC]

GLSA request filed

[Comment 9 Larry the Git Cow 2022-08-14 16:10:05 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=fd3b0a54cba850267bd5f7ed0ac9f66f91aa44ac

commit fd3b0a54cba850267bd5f7ed0ac9f66f91aa44ac
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-08-14 16:09:07 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-08-14 16:09:43 +0000

    [ GLSA 202208-27 ] QEMU: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/733448
    Bug: https://bugs.gentoo.org/736605
    Bug: https://bugs.gentoo.org/773220
    Bug: https://bugs.gentoo.org/775713
    Bug: https://bugs.gentoo.org/780816
    Bug: https://bugs.gentoo.org/792624
    Bug: https://bugs.gentoo.org/807055
    Bug: https://bugs.gentoo.org/810544
    Bug: https://bugs.gentoo.org/820743
    Bug: https://bugs.gentoo.org/835607
    Bug: https://bugs.gentoo.org/839762
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Sam James <[e-mail]>

 glsa-202208-27.xml | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)

[Comment 10 Sam James 2022-08-14 16:10:54 UTC]

GLSA done, all done.