qemu: CVE-2019-8934: ppc64: sPAPR emulator leaks the host hardware identity

Debian Bug report logs - #922923
qemu: CVE-2019-8934: ppc64: sPAPR emulator leaks the host hardware identity

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: qemu: CVE-2019-8934: ppc64: sPAPR emulator leaks the host hardware identity

Date: Thu, 21 Feb 2019 22:22:35 +0100

Source: qemu
Version: 1:3.1+dfsg-4
Severity: normal
Tags: security upstream
Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg04821.html

Hi,

The following vulnerability was published for qemu.

CVE-2019-8934[0]:
ppc64: sPAPR emulator leaks the host hardware identity

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-8934
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8934
[1] https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg04821.html
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1668022

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 922923@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>

To: Salvatore Bonaccorso <carnil@debian.org>, 922923@bugs.debian.org

Subject: Re: Bug#922923: qemu: CVE-2019-8934: ppc64: sPAPR emulator leaks the host hardware identity

Date: Fri, 22 Feb 2019 01:43:39 +0300

22.02.2019 0:22, Salvatore Bonaccorso wrote:
> Source: qemu
> Version: 1:3.1+dfsg-4
> Severity: normal
> Tags: security upstream
> Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg04821.html
> 
> Hi,
> 
> The following vulnerability was published for qemu.
> 
> CVE-2019-8934[0]:
> ppc64: sPAPR emulator leaks the host hardware identity

This one's interesting. The vuln itself and the fix too.
First is described elsewhere.

For the second, we can't "just" fix it, -- the fix is to provide
a way to avoid the "leakage" by a means of a command-line option,
and ofcourse a management tool. if any, to run qemu, needs to know
and use this option.

But it is not all really, since this "fix" breaks migration stream
format, so it can't just be backported to 3.1 (the fix applies to
the ongoing next version of qemu). I dunno how much do we care about
the online migration of a ppc guest, probably not _very_ mich, so
this might be an easy path to take. If it is, we can just use a
stright backport of this patch to current debian 3.1 version and
be done with it (modulo the first part -- something needs to actually
use the fix anyway).

Thanks,

/mjt

Message #15 received at 922923@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <salvatore.bonaccorso@gmail.com>

To: Michael Tokarev <mjt@tls.msk.ru>

Cc: 922923@bugs.debian.org

Subject: Re: Bug#922923: qemu: CVE-2019-8934: ppc64: sPAPR emulator leaks the host hardware identity

Date: Fri, 22 Feb 2019 22:05:02 +0100

Hi Michael,

On Fri, Feb 22, 2019 at 01:43:39AM +0300, Michael Tokarev wrote:
> 22.02.2019 0:22, Salvatore Bonaccorso wrote:
> > Source: qemu
> > Version: 1:3.1+dfsg-4
> > Severity: normal
> > Tags: security upstream
> > Forwarded: https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg04821.html
> > 
> > Hi,
> > 
> > The following vulnerability was published for qemu.
> > 
> > CVE-2019-8934[0]:
> > ppc64: sPAPR emulator leaks the host hardware identity
> 
> This one's interesting. The vuln itself and the fix too.
> First is described elsewhere.
> 
> For the second, we can't "just" fix it, -- the fix is to provide
> a way to avoid the "leakage" by a means of a command-line option,
> and ofcourse a management tool. if any, to run qemu, needs to know
> and use this option.
> 
> But it is not all really, since this "fix" breaks migration stream
> format, so it can't just be backported to 3.1 (the fix applies to
> the ongoing next version of qemu). I dunno how much do we care about
> the online migration of a ppc guest, probably not _very_ mich, so
> this might be an easy path to take. If it is, we can just use a
> stright backport of this patch to current debian 3.1 version and
> be done with it (modulo the first part -- something needs to actually
> use the fix anyway).

Thanks for the explanations. So I guess it's safest to just wait for
the respective upstream version which will integrate the fixes and
furthermore not try to backport fixes to older versions.

Regards,
Salvatore

Send a report that this bug log contains spam.