qemu: CVE-2017-9374: usb: ehci host memory leakage during hotunplug

Debian Bug report logs - #864568
qemu: CVE-2017-9374: usb: ehci host memory leakage during hotunplug

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: qemu: CVE-2017-9374: usb: ehci host memory leakage during hotunplug

Date: Sat, 10 Jun 2017 21:25:32 +0200

Source: qemu
Version: 1:2.8+dfsg-6
Severity: normal
Tags: security patch upstream

Hi,

the following vulnerability was published for qemu.

CVE-2017-9374[0]:
usb: ehci host memory leakage during hotunplug

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-9374
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9374

Please adjust the affected versions in the BTS as needed, I only
checked the unstable source.

Regards,
Salvatore

Message #14 received at 864568@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 863840@bugs.debian.org, 863943@bugs.debian.org, 864216@bugs.debian.org, 864219@bugs.debian.org, 864568@bugs.debian.org, 866674@bugs.debian.org, 865755@bugs.debian.org, 869706@bugs.debian.org

Subject: raising severity since fixed in stable but not yet in unstable

Date: Thu, 27 Jul 2017 11:44:25 +0200

severity 863840 serious
severity 863943 serious
severity 864216 serious
severity 864219 serious
severity 864568 serious
severity 866674 serious
severity 865755 serious
severity 869706 serious
thanks

Hi Michael,

I'm raising the severity to RC for those bugs which were addressed in
stable but not yet in unstable, since that means a regression in
security fixes. I know it's just pro-forma, since at some point a
newer update of qemu will include those and likely to be fixed in time
for buster :)

Regards,
Salvatore

Message #23 received at 864568-close@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>

To: 864568-close@bugs.debian.org

Subject: Bug#864568: fixed in qemu 1:2.8+dfsg-6+deb9u1

Date: Thu, 07 Sep 2017 17:48:15 +0000

Source: qemu
Source-Version: 1:2.8+dfsg-6+deb9u1

We believe that the bug you reported is fixed in the latest version of
qemu, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 864568@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Tokarev <mjt@tls.msk.ru> (supplier of updated qemu package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Wed, 12 Jul 2017 11:05:16 +0300
Source: qemu
Binary: qemu qemu-system qemu-block-extra qemu-system-common qemu-system-misc qemu-system-arm qemu-system-mips qemu-system-ppc qemu-system-sparc qemu-system-x86 qemu-user qemu-user-static qemu-user-binfmt qemu-utils qemu-guest-agent qemu-kvm
Architecture: source amd64
Version: 1:2.8+dfsg-6+deb9u1
Distribution: stretch-security
Urgency: high
Maintainer: Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Description:
 qemu       - fast processor emulator
 qemu-block-extra - extra block backend modules for qemu-system and qemu-utils
 qemu-guest-agent - Guest-side qemu-system agent
 qemu-kvm   - QEMU Full virtualization on x86 hardware
 qemu-system - QEMU full system emulation binaries
 qemu-system-arm - QEMU full system emulation binaries (arm)
 qemu-system-common - QEMU full system emulation binaries (common files)
 qemu-system-mips - QEMU full system emulation binaries (mips)
 qemu-system-misc - QEMU full system emulation binaries (miscellaneous)
 qemu-system-ppc - QEMU full system emulation binaries (ppc)
 qemu-system-sparc - QEMU full system emulation binaries (sparc)
 qemu-system-x86 - QEMU full system emulation binaries (x86)
 qemu-user  - QEMU user mode emulation binaries
 qemu-user-binfmt - QEMU user mode binfmt registration for qemu-user
 qemu-user-static - QEMU user mode emulation binaries (static version)
 qemu-utils - QEMU utilities
Closes: 863840 863943 864216 864219 864568 865755 866674
Changes:
 qemu (1:2.8+dfsg-6+deb9u1) stretch-security; urgency=high
 .
   * net-e1000e-fix-an-infinite-loop-issue-CVE-2017-9310.patch
     Closes: #863840, CVE-2017-9310
   * usb-ohci-fix-error-return-code-in-servicing-iso-td-CVE-2017-9330.patch
     Closes: #863943, CVE-2017-9330
   * ide-ahci-call-cleanup-function-in-ahci-unit-CVE-2017-9373.patch
     Closes: #864216, CVE-2017-9373
   * xhci-guard-xhci_kick_epctx-against-recursive-calls-CVE-2017-9375.patch
     Closes: #864219, CVE-2017-9375
   * usb-ehci-fix-memory-leak-in-ehci-CVE-2017-9374.patch
     Closes: #864568, CVE-2017-9374
   * nbd-ignore-SIGPIPE-CVE-2017-10664.patch
     Closes: #866674, CVE-2017-10664
   * nbd-fully-initialize-client-in-case-of-failed-negotiation-CVE-2017-9524.patch
     nbd-fix-regression-on-resiliency-to-port-scan-CVE-2017-9524.patch
     Closes: #865755, CVE-2017-9524
   * xen-disk-don-t-leak-stack-data-via-response-ring-CVE-2017-10911.patch
     Closes: CVE-2017-10911
Checksums-Sha1:
 8399e608280e1a88159bfdabf1fafee51008fae0 5579 qemu_2.8+dfsg-6+deb9u1.dsc
 fa9150a6c78c7758900878011d0ff62831695f1c 7040728 qemu_2.8+dfsg.orig.tar.xz
 3b1075a12b0fd2657b6d1b88e95d09891c958556 124524 qemu_2.8+dfsg-6+deb9u1.debian.tar.xz
 bf2213a301b486027000bc42250604cad914327e 275740 qemu-block-extra-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 ad025ed5b80f3ed8e1aecc3871b250303c0f06b2 103998 qemu-block-extra_2.8+dfsg-6+deb9u1_amd64.deb
 7d41fddd264037b814504c7626e4a12bfca886ec 770788 qemu-guest-agent-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 7d8ff70edeb81f6a968c7b9631247959881317a4 312652 qemu-guest-agent_2.8+dfsg-6+deb9u1_amd64.deb
 014943e3f2b072a9ef22c46db9bc3ab45c512b83 65228 qemu-kvm_2.8+dfsg-6+deb9u1_amd64.deb
 9fd5bfc9ef6e9aa33cf0cbcbd15d896dd5914ff8 33544020 qemu-system-arm-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 58da15fd5da50a2e8c06d17d3e99caa5df07f9e9 5260594 qemu-system-arm_2.8+dfsg-6+deb9u1_amd64.deb
 2dcf33de372eb2f05043be0d8ee1b0f52595e45d 329230 qemu-system-common-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 c5734d2254438d72dd9930d219c16f10fee74423 499878 qemu-system-common_2.8+dfsg-6+deb9u1_amd64.deb
 35462c94d85465fc21a25700aa6cd3d07cd1ebb9 57858786 qemu-system-mips-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 1cf845b9db7329d3d884decf563059dd22146296 8950010 qemu-system-mips_2.8+dfsg-6+deb9u1_amd64.deb
 68172ea2e92e16caca53e48f784022e32af50490 151327690 qemu-system-misc-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 1b8ca540915dfa68b0911d5e6b598acb6824d12c 13495018 qemu-system-misc_2.8+dfsg-6+deb9u1_amd64.deb
 8368ddad3e30d623cc46cd0f9e4251cb6e19bdb7 44696892 qemu-system-ppc-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 c36db0d52f8e0c390355f5b8bb3b8801e54ab952 7026118 qemu-system-ppc_2.8+dfsg-6+deb9u1_amd64.deb
 67924e2f10c236c426e28418b19774dc04483a67 22534262 qemu-system-sparc-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 fbbf6d9b8a1fc96d13abafc5c9031d3948812ae6 2568258 qemu-system-sparc_2.8+dfsg-6+deb9u1_amd64.deb
 1fb6468ae98f7da692105b012edd70bc6bfae297 31934022 qemu-system-x86-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 7fbbb9c21c96c56b06513eb5531906352cc21c36 4798080 qemu-system-x86_2.8+dfsg-6+deb9u1_amd64.deb
 e6903c0c8d8e061a940ecec9496d730b56564ca3 64248 qemu-system_2.8+dfsg-6+deb9u1_amd64.deb
 c48a701ae2524f14f993bf5d58737d25b1f124a1 2584 qemu-user-binfmt_2.8+dfsg-6+deb9u1_amd64.deb
 4560ea3a89ffbea0647779d1925c5e7514eba711 80350978 qemu-user-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 ef1ad94105e6df7befe3f8ab045fbacf2f7fb920 88159200 qemu-user-static-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 0aaee5100cb8375d6a3eec2bb1484e678dfc2719 8989346 qemu-user-static_2.8+dfsg-6+deb9u1_amd64.deb
 edc624c4203e2de8411fc2d6d5c0276b20f8d66e 7934592 qemu-user_2.8+dfsg-6+deb9u1_amd64.deb
 99a3012966e782a9c78678862c86f0739a8a5aec 9728280 qemu-utils-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 f25bd2ebf3b451331c1f09be76a53e4319005f6d 983396 qemu-utils_2.8+dfsg-6+deb9u1_amd64.deb
 e8e00c51cd1e7fabcf00246ae5747da4ec5c9d55 20838 qemu_2.8+dfsg-6+deb9u1_amd64.buildinfo
 cb373275cc8e4fa62728cf32e596716941fffd0f 149188 qemu_2.8+dfsg-6+deb9u1_amd64.deb
Checksums-Sha256:
 a0cafdc7248d5e9f8a5e919f92fea560faa2fbb9e6068457b2517382673fd164 5579 qemu_2.8+dfsg-6+deb9u1.dsc
 780abde8ee1f3847bf96b2ae2515ba68bda20734ece3d1017ca6128b3b2a97a6 7040728 qemu_2.8+dfsg.orig.tar.xz
 7fef5e46d8f5b49e8b595b6dee368cb0310bd10dade1f4ab16b9d09d03c75175 124524 qemu_2.8+dfsg-6+deb9u1.debian.tar.xz
 1e3138c8fa5e7ada1f2142ce39b02878fb9bbb2f980339ed109d18a3e546cc26 275740 qemu-block-extra-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 072cdfe6f8ee9edae6830d9d8709f1b5d27cc4f1256c3961a72e4cab1c48a126 103998 qemu-block-extra_2.8+dfsg-6+deb9u1_amd64.deb
 0da1d7009ae778f5002caf5e2c86e9712662c90f6eae7bf3fa4fdc82f836f3b9 770788 qemu-guest-agent-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 81760d068492ed8aeff94de6747dbc365658c4384fb52ce934309a2c55fd6fde 312652 qemu-guest-agent_2.8+dfsg-6+deb9u1_amd64.deb
 19e74a38337f0c1d800a95a56bb86d240cb4895a519bde70401b7415422694d0 65228 qemu-kvm_2.8+dfsg-6+deb9u1_amd64.deb
 7757207e2bed7c1e9925aafe40f3d20dbe76ad7872bbcff4c587081421a6dd3b 33544020 qemu-system-arm-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 5d0f184e12a195c6026ebd94ff058928455d42391e67f94691619aeac268c027 5260594 qemu-system-arm_2.8+dfsg-6+deb9u1_amd64.deb
 9e2757f431ed656e234d18fbf9c94658ad4b0e093d7929cbdbdb9b2c8e58f785 329230 qemu-system-common-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 b44e9868f7dc3d0fa7da47d46bca73639da8a4bb997952d4d3e8a8cf8bc41d1b 499878 qemu-system-common_2.8+dfsg-6+deb9u1_amd64.deb
 6984e2171f8e7d2ec4dada9789925cf70d1a5b5afad5a5e6f81eaf5ab776c056 57858786 qemu-system-mips-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 24cc0b0ccc40a53e4efabc934addefbcf01bc2c11355ee2e59db22d00379a927 8950010 qemu-system-mips_2.8+dfsg-6+deb9u1_amd64.deb
 eb6c8a36c119dc6c4fd835921711d0c32786a09ab54233f17a983e383b9d6aba 151327690 qemu-system-misc-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 e2282a85889e783e13de9836ddad2065287b0b9d8ab602f82f4433809c00ae43 13495018 qemu-system-misc_2.8+dfsg-6+deb9u1_amd64.deb
 95e8019cb00d1636d4c3e1303d27547a829d1663efb9388fd14ab51afdf170a9 44696892 qemu-system-ppc-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 8dc11086fa74380949e3cac8267e4f2ae81efb0531a481ef304dfbf1551cd11e 7026118 qemu-system-ppc_2.8+dfsg-6+deb9u1_amd64.deb
 36bc93573998dae239a3688b2fe23b2bfe8b61cda117010a5c0d95fe6f8d23e0 22534262 qemu-system-sparc-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 5333b7d66340dbd145f868cc80f222ad8926914b5a1397d37af39c11b837c577 2568258 qemu-system-sparc_2.8+dfsg-6+deb9u1_amd64.deb
 7e3f5ef467e98398ec8f62c018934acf12ed604c6852b46f1aeca35a2e822aa7 31934022 qemu-system-x86-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 3b94680c2ad364c0aee269b606c96d8e55eac4d2f5bd6228df7a9eaba4431715 4798080 qemu-system-x86_2.8+dfsg-6+deb9u1_amd64.deb
 e8f194e0eb3f797bc8b3527c7740a80ae0528bb81fe1a187a8326f07f63898ff 64248 qemu-system_2.8+dfsg-6+deb9u1_amd64.deb
 3c60d526fd1e5358dce1f527a16c4bb0fa947d47b54010aa074c0389d0467aef 2584 qemu-user-binfmt_2.8+dfsg-6+deb9u1_amd64.deb
 6f5483a559434d9becfb283cc0a22f30e664156bb16dcac47effd6ed1db98828 80350978 qemu-user-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 4b5ec31e3bb7fd3a6964d9030c196ee8a1b64e454469a54483d0429447115f9d 88159200 qemu-user-static-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 3a6298a08ae75fd9b123fc5826f0a65d9bd57d9578fe7b86f4924d974dd0d3f3 8989346 qemu-user-static_2.8+dfsg-6+deb9u1_amd64.deb
 c1a1768110c9b0f76ad99cbae052822d86c2f43477f279a76a38a754fc68d903 7934592 qemu-user_2.8+dfsg-6+deb9u1_amd64.deb
 a652403f0fc51160cd4b994892bea800d6ccd4b912f50d12ec2bbc8d382b016a 9728280 qemu-utils-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 80de9107e9958b02cdb375e5680c861933ca9e05281adc7b671e696bb5b5bcb6 983396 qemu-utils_2.8+dfsg-6+deb9u1_amd64.deb
 6cea375f23afd668c071d5956da7125dbce28546bfc3fc50c3590fd923e004db 20838 qemu_2.8+dfsg-6+deb9u1_amd64.buildinfo
 5d9ad63c16a364b90555e8f3cde8a2b784e8debe20e275b8e7818822f73d48c6 149188 qemu_2.8+dfsg-6+deb9u1_amd64.deb
Files:
 976c289333b546f44f070525d5df6f26 5579 otherosfs optional qemu_2.8+dfsg-6+deb9u1.dsc
 998051c35e5a70e0bbab382e1046e674 7040728 otherosfs optional qemu_2.8+dfsg.orig.tar.xz
 ea835555aeecd1e476ffee4b7e40bae9 124524 otherosfs optional qemu_2.8+dfsg-6+deb9u1.debian.tar.xz
 bfb70bf141221f1682d4e43c2fb9adf2 275740 debug extra qemu-block-extra-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 ccd34f831ecb369bfe72002bd44c9fc3 103998 otherosfs optional qemu-block-extra_2.8+dfsg-6+deb9u1_amd64.deb
 c304b48b85f8aec4bb8f97159a06a594 770788 debug extra qemu-guest-agent-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 dc06f8757f40f7511370e56ccba3a9ef 312652 otherosfs optional qemu-guest-agent_2.8+dfsg-6+deb9u1_amd64.deb
 dbde56bca302c343d6c6a0c532d459a7 65228 otherosfs optional qemu-kvm_2.8+dfsg-6+deb9u1_amd64.deb
 1034c63b2c84c00eef9ccdd7bad535b2 33544020 debug extra qemu-system-arm-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 3de2f60fde8865b5da2d8d664f509909 5260594 otherosfs optional qemu-system-arm_2.8+dfsg-6+deb9u1_amd64.deb
 b250d4424467511ed6eeef6e132423c7 329230 debug extra qemu-system-common-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 c1a315a208e60c8655060ce3e037f854 499878 otherosfs optional qemu-system-common_2.8+dfsg-6+deb9u1_amd64.deb
 39a8f99eae21af4a342a1d6053ef5e74 57858786 debug extra qemu-system-mips-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 966ebea93d36bcba51a3b3192c3e1b76 8950010 otherosfs optional qemu-system-mips_2.8+dfsg-6+deb9u1_amd64.deb
 0435410cd790cb8bd5973ec8b5e384da 151327690 debug extra qemu-system-misc-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 b045c8468da5c483b545bbfdab9d8932 13495018 otherosfs optional qemu-system-misc_2.8+dfsg-6+deb9u1_amd64.deb
 644d79ae822fc1bece9afbb3ba645a2a 44696892 debug extra qemu-system-ppc-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 52f351d8138ea28bf00aaa3b770b22e1 7026118 otherosfs optional qemu-system-ppc_2.8+dfsg-6+deb9u1_amd64.deb
 95f606f691f3429eadaef42b2200dc78 22534262 debug extra qemu-system-sparc-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 92cee2d428abcd6b6a0f302d50b004f3 2568258 otherosfs optional qemu-system-sparc_2.8+dfsg-6+deb9u1_amd64.deb
 39d4935a8758fb5e20c33d10987c9148 31934022 debug extra qemu-system-x86-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 baa37bae74e5ad13bd399f313339de95 4798080 otherosfs optional qemu-system-x86_2.8+dfsg-6+deb9u1_amd64.deb
 cf5ab10926be39b2b4ebbce2d0113df3 64248 otherosfs optional qemu-system_2.8+dfsg-6+deb9u1_amd64.deb
 2c1e217748af4e1605f517dd1ffe0618 2584 otherosfs optional qemu-user-binfmt_2.8+dfsg-6+deb9u1_amd64.deb
 a353108ce86d5a57e2d26664b4ab111a 80350978 debug extra qemu-user-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 fce5dbf3a36fb82751b500dd5ae8f69a 88159200 debug extra qemu-user-static-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 d962feb6af0f6b5905e186a572e0459a 8989346 otherosfs optional qemu-user-static_2.8+dfsg-6+deb9u1_amd64.deb
 048361f6e2a2b5485e3503a34d4ae0fc 7934592 otherosfs optional qemu-user_2.8+dfsg-6+deb9u1_amd64.deb
 59638f1681720ab6899a9ccfecb76695 9728280 debug extra qemu-utils-dbgsym_2.8+dfsg-6+deb9u1_amd64.deb
 242b9f38281fc0f3c8ad91897ed8182e 983396 otherosfs optional qemu-utils_2.8+dfsg-6+deb9u1_amd64.deb
 8891bd634fe055ce2752f452160f6bdd 20838 otherosfs optional qemu_2.8+dfsg-6+deb9u1_amd64.buildinfo
 598374965b84cb7a7d71d80ab0d844fc 149188 otherosfs optional qemu_2.8+dfsg-6+deb9u1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQFDBAEBCAAtFiEEe3O61ovnosKJMUsicBtPaxppPlkFAlloaPQPHG1qdEB0bHMu
bXNrLnJ1AAoJEHAbT2saaT5ZfUoH+QFGV/A4vCplyh4x4T0c0YkIsyaICTBueYeo
5vP6qD+aRrGs3Q18FDLMHQ5DjYQQ+Kh4P7t0elbJvYA/HnzU8jZp87ug95lw9xhs
rfFnb61Iw8EY4F+wo1vVoMJ+eEifGvgbUrRWbkxFUu/hgpcZkzLKTKimV3+Cj7fM
kZUcbROzk8HSYRMgzwIbEBJT8xa4GqTWJIkNfd7QPtjpQtOfINwR8Aq8FgOteJ0C
RxgngN8I/Il4CUeyWXQv4ZfHQHvmgq8vEL+4uKyOY58xPjG/Umje/zS6SC3UuHrj
qCTmaPFlZ/0psKmVXHkz2I0VxZk8F4Ir33f3rlnwG9BQxes1BDU=
=b8vq
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.