Bug 1071228 (CVE-2017-17381) - VUL-1: CVE-2017-17381: qemu: virtio: divide by zero exception while updating rings
Summary: VUL-1: CVE-2017-17381: qemu: virtio: divide by zero exception while updating ...
Status: RESOLVED FIXED
Alias: CVE-2017-17381
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Liang Yan
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/196138/
Whiteboard: CVSSv2:SUSE:CVE-2017-17381:1.9:(AV:L/...
Keywords:
Depends on:
Blocks:
 
Reported: 2017-12-05 09:07 UTC by Johannes Segitz
Modified: 2019-04-26 21:26 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2017-12-05 09:07:24 UTC 
rh#1520782

Virtio Vring implementation in Quick Emulator(QEMU) is vulnerable
to an arithmetic exception issue. It could occur if a guest was
to unset vring alignment while updating Virtio rings.

A guest user/process could use this flaw to crash Qemu process
resulting in DoS.

Patch: https://lists.gnu.org/archive/html/qemu-devel/2017-12/msg00166.html

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1520782
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-17381
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17381
Comment 1 Liang Yan 2018-02-26 20:24:54 UTC 
Merged into upstream 2.11 :

commit 758ead31c7e17bf17a9ef2e0ca1c3e86ab296b43
Author: Prasad J Pandit <pjp@fedoraproject.org>
Date:   Wed Nov 29 23:14:27 2017 +0530

    virtio: check VirtQueue Vring object is set
    
    A guest could attempt to use an uninitialised VirtQueue object
    or unset Vring.align leading to a arithmetic exception. Add check
    to avoid it.
Comment 2 Swamp Workflow Management 2018-03-21 20:08:06 UTC 
SUSE-SU-2018:0762-1: An update that solves 8 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1040202,1068032,1068613,1070144,1071228,1073489,1074572,1076114,1076775,1076813,1082276,1083291
CVE References: CVE-2017-15119,CVE-2017-15124,CVE-2017-16845,CVE-2017-17381,CVE-2017-18043,CVE-2017-5715,CVE-2018-5683,CVE-2018-7550
Sources used:
SUSE Linux Enterprise Server 12-SP3 (src):    qemu-2.9.1-6.12.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    qemu-2.9.1-6.12.1
SUSE CaaS Platform ALL (src):    qemu-2.9.1-6.12.1
Comment 3 Swamp Workflow Management 2018-03-22 23:07:55 UTC 
openSUSE-SU-2018:0780-1: An update that solves 8 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1040202,1068032,1068613,1070144,1071228,1073489,1074572,1076114,1076775,1076813,1082276,1083291
CVE References: CVE-2017-15119,CVE-2017-15124,CVE-2017-16845,CVE-2017-17381,CVE-2017-18043,CVE-2017-5715,CVE-2018-5683,CVE-2018-7550
Sources used:
openSUSE Leap 42.3 (src):    qemu-2.9.1-41.1, qemu-linux-user-2.9.1-41.1, qemu-testsuite-2.9.1-41.1
Comment 4 Swamp Workflow Management 2018-03-27 19:09:28 UTC 
SUSE-SU-2018:0831-1: An update that solves 9 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 1040202,1068032,1068613,1070144,1071228,1073489,1076114,1076179,1076775,1076814,1082276,1083291,1085598
CVE References: CVE-2017-15119,CVE-2017-15124,CVE-2017-16845,CVE-2017-17381,CVE-2017-18030,CVE-2017-18043,CVE-2017-5715,CVE-2018-5683,CVE-2018-7550
Sources used:
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    qemu-2.6.2-41.37.1
SUSE Linux Enterprise Server 12-SP2 (src):    qemu-2.6.2-41.37.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    qemu-2.6.2-41.37.1
Comment 5 Liang Yan 2019-04-26 21:26:54 UTC 
Personal bug clean up. Free free to reopen it if you have further questions.