{ "threat_severity" : "Moderate", "public_date" : "2020-05-27T00:00:00Z", "bugzilla" : { "description" : "QEMU: slirp: networking out-of-bounds read information disclosure vulnerability", "id" : "1835986", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1835986" }, "cvss3" : { "cvss3_base_score" : "6.5", "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "status" : "verified" }, "cwe" : "CWE-125", "details" : [ "An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1.", "An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure." ], "statement" : "This flaw did not affect the versions of SLiRP embedded in `qemu-kvm` as shipped with Red Hat Enterprise Linux 6 and 7, as they did not include support for ICMPv6, which was introduced in a later version of the package.\nOpenShift 4.x packages slirp4netns as a dependency of podman however podman doesn't set the --enable-ipv6 flag. Hence the impact has been reduced to low, as the code is still being packaged and podman might decide to enable IPv6 in future.\nIn Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP qemu-kvm-rhev package.", "acknowledgement" : "Red Hat would like to thank VictorV (360 Vulcan Team) and Ziming Zhang (Qi An Xin Group) for reporting this issue.", "affected_release" : [ { "product_name" : "Advanced Virtualization for RHEL 8.2.1", "release_date" : "2020-09-01T00:00:00Z", "advisory" : "RHSA-2020:3586", "cpe" : "cpe:/a:redhat:advanced_virtualization:8.2::el8", "package" : "virt:8.2-8020120200820190722.863bb0db" }, { "product_name" : "Advanced Virtualization for RHEL 8.2.1", "release_date" : "2020-09-01T00:00:00Z", "advisory" : "RHSA-2020:3586", "cpe" : "cpe:/a:redhat:advanced_virtualization:8.2::el8", "package" : "virt-devel:8.2-8020120200820190722.863bb0db" }, { "product_name" : "Red Hat Enterprise Linux 8", "release_date" : "2020-09-29T00:00:00Z", "advisory" : "RHSA-2020:4059", "cpe" : "cpe:/a:redhat:enterprise_linux:8", "package" : "virt-devel:rhel-8020020200909224913.4cda2c84" }, { "product_name" : "Red Hat Enterprise Linux 8", "release_date" : "2020-09-29T00:00:00Z", "advisory" : "RHSA-2020:4059", "cpe" : "cpe:/a:redhat:enterprise_linux:8", "package" : "virt:rhel-8020020200909224913.4cda2c84" }, { "product_name" : "Red Hat Enterprise Linux 8", "release_date" : "2020-11-04T00:00:00Z", "advisory" : "RHSA-2020:4694", "cpe" : "cpe:/a:redhat:enterprise_linux:8", "package" : "container-tools:rhel8-8030020200923153805.2a301c24" } ], "package_state" : [ { "product_name" : "Red Hat Enterprise Linux 5", "fix_state" : "Out of support scope", "package_name" : "kvm", "cpe" : "cpe:/o:redhat:enterprise_linux:5" }, { "product_name" : "Red Hat Enterprise Linux 6", "fix_state" : "Not affected", "package_name" : "qemu-kvm", "cpe" : "cpe:/o:redhat:enterprise_linux:6" }, { "product_name" : "Red Hat Enterprise Linux 7", "fix_state" : "Not affected", "package_name" : "qemu-kvm", "cpe" : "cpe:/o:redhat:enterprise_linux:7" }, { "product_name" : "Red Hat Enterprise Linux 7", "fix_state" : "Will not fix", "package_name" : "qemu-kvm-ma", "cpe" : "cpe:/o:redhat:enterprise_linux:7" }, { "product_name" : "Red Hat Enterprise Linux 7", "fix_state" : "Will not fix", "package_name" : "qemu-kvm-rhev", "cpe" : "cpe:/o:redhat:enterprise_linux:7" }, { "product_name" : "Red Hat Enterprise Linux 7", "fix_state" : "Will not fix", "package_name" : "slirp4netns", "cpe" : "cpe:/o:redhat:enterprise_linux:7" }, { "product_name" : "Red Hat Enterprise Linux 8", "fix_state" : "Out of support scope", "package_name" : "container-tools:1.0/slirp4netns", "cpe" : "cpe:/o:redhat:enterprise_linux:8" }, { "product_name" : "Red Hat Enterprise Linux 8", "fix_state" : "Affected", "package_name" : "container-tools:2.0/slirp4netns", "cpe" : "cpe:/o:redhat:enterprise_linux:8" }, { "product_name" : "Red Hat Enterprise Linux 8 Advanced Virtualization", "fix_state" : "Affected", "package_name" : "virt:8.1/qemu-kvm", "cpe" : "cpe:/a:redhat:advanced_virtualization:8::el8" }, { "product_name" : "Red Hat Enterprise Linux 8 Advanced Virtualization", "fix_state" : "Affected", "package_name" : "virt:8.2/qemu-kvm", "cpe" : "cpe:/a:redhat:advanced_virtualization:8::el8" }, { "product_name" : "Red Hat Enterprise Linux 8 Advanced Virtualization", "fix_state" : "Affected", "package_name" : "virt:8.3/qemu-kvm", "cpe" : "cpe:/a:redhat:advanced_virtualization:8::el8" }, { "product_name" : "Red Hat Enterprise Linux 9", "fix_state" : "Not affected", "package_name" : "qemu-kvm", "cpe" : "cpe:/o:redhat:enterprise_linux:9" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "slirp4netns", "cpe" : "cpe:/a:redhat:openshift:4", "impact" : "low" }, { "product_name" : "Red Hat OpenStack Platform 10 (Newton)", "fix_state" : "Will not fix", "package_name" : "qemu-kvm-rhev", "cpe" : "cpe:/a:redhat:openstack:10" }, { "product_name" : "Red Hat OpenStack Platform 13 (Queens)", "fix_state" : "Will not fix", "package_name" : "qemu-kvm-rhev", "cpe" : "cpe:/a:redhat:openstack:13" } ], "references" : [ "https://www.cve.org/CVERecord?id=CVE-2020-10756\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-10756\nhttps://www.zerodayinitiative.com/advisories/ZDI-20-1005/" ], "name" : "CVE-2020-10756", "csaw" : false }