Nelson Elhage discoverd that QEMU did not properly validate certain virtqueue requests from the guest. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. (CVE-2011-2212) Stefan Hajnoczi discovered that QEMU did not properly perform integer comparisons when performing virtqueue input validation. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. (CVE-2011-2512) When using QEMU with libvirt or virtualization management software based on libvirt such as Eucalyptus and OpenStack, QEMU guests are individually isolated by an AppArmor profile by default in Ubuntu. Update instructions: The problem can be corrected by updating your system
CC: (none) => cjw, fundawang, mageia, misc, thierry.vignaud
So here is a patch for CVE-2011-2512 http://patchwork.ozlabs.org/patch/94604/
Status: NEW => ASSIGNEDAssignee: bugsquad => misc
And here is one for CVE-2011-2212 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632987
Pushed in update_testing as qemu-0.14.0-5.1.mga1 In order to test and since it involve virtio, I would make sure that testers use a virtio disk. The easiest way is to use virt-manager for that, and try to install a recent supported distribution and specify to use virtio ( like making sure we use virtio-net-pci ) . But doing this directly on the command line should be good too. Since I run mageia in a vm, I cannot test kvm in it, so I didn't test much the update :/ Advisory : Nelson Elhage discoverd that QEMU did not properly validate certain virtqueue requests from the guest. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. (CVE-2011-2212) Stefan Hajnoczi discovered that QEMU did not properly perform integer comparisons when performing virtqueue input validation. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. (CVE-2011-2512) Updated package are provided to fix theses issues.
Assignee: misc => qa-bugs
Seems there is also https://bugs.mageia.org/show_bug.cgi?id=1423 I will add proper patch for CVE-2011-1751
Assignee: qa-bugs => misc
*** Bug 1423 has been marked as a duplicate of this bug. ***
Must qa team test this one or should we wait for the patch for CVE-2011-1751
CC: (none) => stormi
According to changelog, I still didn't added it ( yet )
Ok, and after svn up, seems I have pushed the patch. According to the changelog of the rpm too.
Keywords: (none) => Security
CC: fundawang => (none)
I'm not familiar with qemu, is there a simple test for this one please?
I'm testing on i586 following http://fedoraproject.org/wiki/How_to_use_qemu#Qemu_virtual_machine_installation Note that a bootable installation cd/dvd must be in the physical drive. As qemu appears to be affected by bug 44, I'm testing with a knoppix boot dvd.
CC: (none) => davidwhodgins
On my i586 system, qemu-0.14.0-5.1.mga1.src.rpm is working. Much slower than VirtualBox, but it is working.
x86_64 ubuntu 11.04 installed under virt-manager using Generic 2.6.25 + virtio option. It confirmed it was using virtio as the disk was labelled such during installation. Tested OK. Update validated. Advisory: ---------------- Nelson Elhage discoverd that QEMU did not properly validate certain virtqueue requests from the guest. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. (CVE-2011-2212) Stefan Hajnoczi discovered that QEMU did not properly perform integer comparisons when performing virtqueue input validation. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. (CVE-2011-2512) Updated packages are provided to fix theses issues. ---------------- Source RPM: qemu-0.14.0-5.1.mga1.src.rpm Sysadmin please push from core/updates_testing to core/updates Thankyou!
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugsVersion: Cauldron => 1
update pushed.
Status: ASSIGNED => RESOLVEDCC: (none) => dmorganecResolution: (none) => FIXED