[security-announce] Security Update: Qemu upgrade to 2.8.1.1, fix for CVE-2017-2620

Sona Sarmadi sona.sarmadi at enea.com
Sat May 20 18:20:52 CEST 2017


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

	Enea Linux Security Advisory

====================================================================
Product/package: Enea Linux 6.0: (Qemu 2.8.0 -> 2.8.1.1)
Severity: High
Architecture: ALL
CVE Name: See below
====================================================================

The Quick Emulator (Qemu) software package as used in Enea Linux 6.0
has been updated to 2.8.1.1 version. The upgrade addresses following
vulnerability:

CVE-2017-2620: display: cirrus: potential arbitrary code execution via
cirrus_bitblt_cputovideo

Description
===========
Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator
support is vulnerable to an out-of-bounds access issue. The issue
could occur while copying VGA data in cirrus_bitblt_cputovideo. A
privileged user inside guest could use this flaw to crash the QEMU
process OR potentially execute arbitrary code on host with privileges
of the QEMU process.


References:
http://wiki.qemu.org/ChangeLog
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620


Reference to Enea Linux corrections
===================================
https://git.enea.com/cgit/linux/poky.git/patch/?id=bf0c5869f5f9a77d6c7c1
adfb7c802d5bb0a1a74


How to get the latest patches
=============================
- - If you have already cloned needed repositories, update it to get new
security patches.

cd Enea-Linux-6.0
$ repo sync

- - If you have not yet cloned needed repositories, do it as described
below. (Security patches are fetched implicitly when cloning the repos).

Use repo tool to download the source for the Enea Linux 6.0 standard,
follow the steps below:
1. Make sure that the repo tool is installed. If not, follow the
instructions below:

$ curl https://storage.googleapis.com/git-repo-downloads/repo >
~/bin/repo $ chmod a+x ~/bin/repo

The instruction assumes that ~/bin exists and is included in the PATH
variable.

2.Use the repo tool to download the source:
$ mkdir Enea-Linux-6.0
$ cd Enea-Linux-6.0
$ repo init -u git://git.enea.com/linux/el_manifests-standard.git -b
krogoth -m <manifest file>
$ repo sync

The parameter <manifest file> depends on the target:
P2041RDB: p2041rdb/default.xml
LS1021a-IoT: ls1021aiot/default.xml
QEMUARM: qemuarm/default.xml
QEMUPCC: qemuppc/default.xml
QEMUX86: qemux86/default.xml

If you have any questions regarding the security patches and security
updates please contact security at enea.com.

For gerneral security refer to Enea Linux Security page:
http://www.enea.com/solutions/Enea-Linux/Security/

For the CVEs fixed at Enea Linux releases see CVE list:
http://www.enea.com/products/security/security-updates

For custom packages/releases please use the Support Channel:
http://www.enea.com/solutions/support.

Enea Security Team
Sona Sarmadi
Mobile: +46 70 971 4475
www.enea.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJZIGzkAAoJEAilI68fskZd7A0IAM0zbj22nfeLLgDTMymN5ZGT
DfGKn2CUFPe53l/dcCRXZvw9JUBNXYeVlsKjFhcNVGZUE/QVpcLLE5wbeggjLTMy
FiiFTDZM/zTd1EHH0+2ziKPyIloPrwpZX9qAuS5TH3RpFBM8z30X5dOSQaWO3S8I
mtJCoGtjNIRjQK7ccG6Ci/pZfN9YR+rt/YXYWGpd8R2VVvyh6GYdUTwJa4IyYQB5
3HWLD8Ff/zIrHW4eW1Ivn5YG11Go/om2XRZxJt4/7hr6RHme1kCbPREWYKCWIT7n
DOUib5TcDA+7t/nSW1FnT7c9KRL+gQdqdJTYgMIKGz9B2gldSOk65RZ6VD7S5QA=
=52LO
-----END PGP SIGNATURE-----


More information about the security-announce mailing list