SB2018081714 - OpenSUSE Linux update for qemu

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Heap-based buffer overflow (CVE-ID: CVE-2018-11806)

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The vulnerability exists due to heap-based buffer overflow when insufficient input and validation checking of Slirp networking back-end processes by the m_cat function, as defined in the slirp/mbuf.c source code file. A remote attacker can send malformed, fragmented packets, trigger memory corruption and cause the QEMU process to crash.

2) Speculative Store Bypass (CVE-ID: CVE-2018-3639)

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The weakness exists due to race conditions in CPU cache processing. A local attacker can conduct a side-channel attack to exploit a flaw in the speculative execution of Load and Store instructions to read privileged memory.

Note: the vulnerability is referred to as "Spectre variant 4".

3) Memory corruption (CVE-ID: CVE-2018-7550)

The vulnerability allows an adjacent attacker to execute arbitrary code on the target system.

The weakness exists in the load_multiboot function due to out-of-bounds read or write. An adjacent attacker can load a kernel image during the boot process, which may cause the mh_load_end_addr address to be greater than the mh_bss_end_addr address, trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2018-08/msg00060.html