736605 – (CVE-2020-16092) <app-emulation/qemu-5.1.0: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c (CVE-2020-16092)

Bug 736605 (CVE-2020-16092) - <app-emulation/qemu-5.1.0: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c (CVE-2020-16092)

Summary: <app-emulation/qemu-5.1.0: reachable assertion failure in net_tx_pkt_add_raw_...

Status:	RESOLVED FIXED

Alias:	CVE-2020-16092

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://seclists.org/oss-sec/2020/q3/106
Whiteboard:	B3 [glsa+ cve]
Keywords:

Depends on:
Blocks:

Reported:	2020-08-10 11:04 UTC by filip ambroz
Modified:	2022-08-14 16:11 UTC (History)
CC List:	5 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description filip ambroz 2020-08-10 11:04:06 UTC

An assertion failure issue was found in QEMU in the network packet
processing component. This issue affects the "e1000e" and "vmxnet3"
network devices. This flaw allows a malicious guest user or process to
abort the QEMU process on the host, resulting in a denial of service
condition.

Upstream patch: https://git.qemu.org/?p=qemu.git;a=commit;h=035e69b063835a5fd23cacabd63690a3d84532a8

Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16092
https://nvd.nist.gov/vuln/detail/CVE-2020-16092
https://security-tracker.debian.org/tracker/CVE-2020-16092
https://bugzilla.redhat.com/show_bug.cgi?id=1860283

Comment 1 John Helmert III archtester

2020-08-10 16:30:21 UTC

(In reply to filip ambroz from comment #0)
> An assertion failure issue was found in QEMU in the network packet
> processing component. This issue affects the "e1000e" and "vmxnet3"
> network devices. This flaw allows a malicious guest user or process to
> abort the QEMU process on the host, resulting in a denial of service
> condition.
> 
> Upstream patch:
> https://git.qemu.org/?p=qemu.git;a=commit;
> h=035e69b063835a5fd23cacabd63690a3d84532a8

This should be in 5.1:

qemu $ git tag --contains 035e69b063835
v5.1.0-rc3

Comment 2 Sergei Trofimovich (RETIRED) gentoo-dev

2020-08-10 18:24:46 UTC

We'll pull it in with 5.1.0 release.

Comment 3 John Helmert III archtester

2021-06-13 01:49:11 UTC

Bumped, stabled, cleaned up a while ago.

Comment 4 John Helmert III archtester

2022-08-14 04:42:22 UTC

GLSA request filed

Comment 5 Larry the Git Cow gentoo-dev

2022-08-14 16:10:03 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=fd3b0a54cba850267bd5f7ed0ac9f66f91aa44ac

commit fd3b0a54cba850267bd5f7ed0ac9f66f91aa44ac
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-08-14 16:09:07 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-08-14 16:09:43 +0000

    [ GLSA 202208-27 ] QEMU: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/733448
    Bug: https://bugs.gentoo.org/736605
    Bug: https://bugs.gentoo.org/773220
    Bug: https://bugs.gentoo.org/775713
    Bug: https://bugs.gentoo.org/780816
    Bug: https://bugs.gentoo.org/792624
    Bug: https://bugs.gentoo.org/807055
    Bug: https://bugs.gentoo.org/810544
    Bug: https://bugs.gentoo.org/820743
    Bug: https://bugs.gentoo.org/835607
    Bug: https://bugs.gentoo.org/839762
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202208-27.xml | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)

Comment 6 Sam James archtester

2022-08-14 16:11:02 UTC

GLSA done, all done.