Your message dated Thu, 10 Jan 2013 09:47:54 +0000 with message-id <e1ttejq-0002yn...@franck.debian.org> and subject line Bug#696051: fixed in qemu 1.1.2+dfsg-4 has caused the Debian Bug report #696051, regarding potential guest-side buffer overflow caused by e1000 device emulation and large incoming packets - CVE-2012-6075 to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 696051: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=696051 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Source: qemu Severity: serious Tags: upstream patch pending security When guest does not enable large packet receiving from the qemu-emulated e1000 device, and a large packet is received from the network, qemu will happily transfer whole thing to guest, causing a guest buffer overflow. This is fixed by upstream commit b0d9ffcd0251161c7c92f94804dcf599dfa3edeb , with the following comment by Michael Contreras: Tested with linux guest. This error can potentially be exploited. At the very least it can cause a DoS to a guest system, and in the worse case it could allow remote code execution on the guest system with kernel level privilege. Risk seems low, as the network would need to be configured to allow large packets. So it can be considered a low-risk security issue, too. /mjt
--- End Message ---
--- Begin Message ---Source: qemu Source-Version: 1.1.2+dfsg-4 We believe that the bug you reported is fixed in the latest version of qemu, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 696...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Michael Tokarev <m...@tls.msk.ru> (supplier of updated qemu package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.8 Date: Wed, 09 Jan 2013 23:05:17 +0400 Source: qemu Binary: qemu qemu-keymaps qemu-system qemu-user qemu-user-static qemu-utils Architecture: source all i386 Version: 1.1.2+dfsg-4 Distribution: unstable Urgency: medium Maintainer: Debian QEMU Team <pkg-qemu-de...@lists.alioth.debian.org> Changed-By: Michael Tokarev <m...@tls.msk.ru> Description: qemu - fast processor emulator qemu-keymaps - QEMU keyboard maps qemu-system - QEMU full system emulation binaries qemu-user - QEMU user mode emulation binaries qemu-user-static - QEMU user mode emulation binaries (static version) qemu-utils - QEMU utilities Closes: 668658 696051 Changes: qemu (1.1.2+dfsg-4) unstable; urgency=medium . * linux-user-fix-mips-32-on-64-prealloc-case.patch (Closes: #668658) * e1000-discard-oversized-packets-based-on-SBP_LPE.patch: the second half of the fix for CVE-2012-6075. (Finally Closes: #696051) Checksums-Sha1: 5db147f83cbaef6ffdc0f0a2533f7fc6fae71d10 2425 qemu_1.1.2+dfsg-4.dsc 05ffa5e5e6821887b7a2e16b3c7f93d9b9df02c3 61092 qemu_1.1.2+dfsg-4.debian.tar.gz cd9369b8c6ee033551558527ee89b1a4e83b39ce 48816 qemu-keymaps_1.1.2+dfsg-4_all.deb fac38280fa07cc89ee292574e0633b2991dc0427 114064 qemu_1.1.2+dfsg-4_i386.deb d9bf9a3f1ddc46f45c9e4e5f841287c23ac166d5 28418124 qemu-system_1.1.2+dfsg-4_i386.deb 3c218c49c91ba9121cae8486a2267a1ececeb3bd 7610364 qemu-user_1.1.2+dfsg-4_i386.deb be62e2b4838979d9bf7f8d6732e70f15288d2554 14767092 qemu-user-static_1.1.2+dfsg-4_i386.deb 5ba9555a9f60b9efaea9836d6985b298f012d5f6 711746 qemu-utils_1.1.2+dfsg-4_i386.deb Checksums-Sha256: 974356406950d7c285bfcc8a537ed6ec8dbaceb257a83cb45edd32299a7d1fba 2425 qemu_1.1.2+dfsg-4.dsc 01ad66f39750814b10b918c5933636595e702266577279b923e95d90a653277a 61092 qemu_1.1.2+dfsg-4.debian.tar.gz 0c7ceab99c9c43796b33aa9884754a41ab23819e42315674f013ea11b5945ed1 48816 qemu-keymaps_1.1.2+dfsg-4_all.deb 7c8c79600283d7e3737d40c34fb4a00c93c61170239c059a713b7d73f0dac09f 114064 qemu_1.1.2+dfsg-4_i386.deb ecb4a0c683c455eb22beb24264a73efbbde9a8c84aa2626557cac1843e3cfc3e 28418124 qemu-system_1.1.2+dfsg-4_i386.deb 6e19eb6ea885a7cd3cbfec1cb469814857ad8513b1ea6de062cbe97cf5988686 7610364 qemu-user_1.1.2+dfsg-4_i386.deb 392e7e47fd7fdeb990a5dfb43e2274d363af52735b143afa8db6239905242729 14767092 qemu-user-static_1.1.2+dfsg-4_i386.deb 119eb0b39c8185fa144cb33f05210962d1a0b38c05c68c0820fa814935b83d35 711746 qemu-utils_1.1.2+dfsg-4_i386.deb Files: 3d52c782eb3600346073e42617718adb 2425 misc optional qemu_1.1.2+dfsg-4.dsc 4649babe022de36dd6a7c89314767f52 61092 misc optional qemu_1.1.2+dfsg-4.debian.tar.gz 79845da847292866560279a0d74ba169 48816 misc optional qemu-keymaps_1.1.2+dfsg-4_all.deb 6e8543bb5aaa3255cdbdea8114aa7d91 114064 misc optional qemu_1.1.2+dfsg-4_i386.deb faba2cdb90e754e9cb62d8e59495f998 28418124 misc optional qemu-system_1.1.2+dfsg-4_i386.deb 7c9e706dff2bedad05a5154d8fa1781c 7610364 misc optional qemu-user_1.1.2+dfsg-4_i386.deb 950c27214b82e09061c7d3462ec7c388 14767092 misc optional qemu-user-static_1.1.2+dfsg-4_i386.deb 66f23b1858b93450964f707d22d201bf 711746 misc optional qemu-utils_1.1.2+dfsg-4_i386.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iJwEAQECAAYFAlDuiNMACgkQUlPFrXTwyDhpUgP9Ea+1iEcFlwpNLYSzgqIDZxAh uhhAtYx2q30cifTY9cgBxIy+oONMWLyHY0T+W9/6xwOnXxckQzT4MvI3NPCUtupt bXlQrU1zLy9nA46z6oHQfBMnUkJ1CvbEJtuWQrSIBQ1u7AMY3omPlyvBx18UwNU6 wWK/lQmVaspGfA/hin4= =ILEX -----END PGP SIGNATURE-----
--- End Message ---
