Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 21 Dec 2015 20:16:51 -0500 (EST)
From: cve-assign@...re.org
To: ppandit@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, luodalongde@...il.com
Subject: Re: CVE request: Qemu: scsi: stack based buffer overflow in megasas_ctrl_get_info

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> Qemu emulator built with the SCSI MegaRAID SAS HBA emulation support is
> vulnerable to a stack buffer overflow issue. It occurs while processing the
> SCSI controller's CTRL_GET_INFO command. A privileged guest user could use
> this flaw to crash the Qemu process instance resulting in DoS.

>> A stack overflow issue was reported by Mr Qinghao Tang ... It
>> occurs while processing the SCSI controller's CTRL_GET_INFO command,
>> as the memset(2) call uses driver supplied 'cmd->iov_size' to
>> initialise the '&info' object.

>> scsi: initialise info object with appropriate size

>> While processing controller 'CTRL_GET_INFO' command, the routine
>> 'megasas_ctrl_get_info' overflows the '&info' object size. Use its
>> appropriate size to null initialise it.

> https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg03737.html
> https://bugzilla.redhat.com/show_bug.cgi?id=1284008

Use CVE-2015-8613.

This is not yet available at
http://git.qemu.org/?p=qemu.git;a=history;f=hw/scsi/megasas.c but that
may be an expected place for a later update.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJWeKKaAAoJEL54rhJi8gl5eNgQAL4kqeQPi3YvHQXPrrqYuvBQ
tik3Vi/USlhDPHncbIsjTLAcXepf/q5mCAuCJZaoAhzoaPNxkPVHz3idGb4wbYd5
LacANo4hAAxoxdNn0KXZmWtkDz+8Zbf0VnawY2xGMoPDk+KvczPxboE6vupyth00
7+JxihRYVEzY2JPZVOF5YYPa/hdytkQvw0iAOAZsgBsXlCMcJIBZcwgwbem8ibrR
+UBtQ++/bL6UOX3bmADxsmDQr6IHO4yGaS5zGSYYb6fUROKDeG1Q1y5AT+F1t2tC
O8YC+TFyadtFFWU5Ps7yW8hJ9+ACe5IygFSiHfoSCSSFz1wtZwHdNmQBb6Gfojy1
HGnMiC8d5/LnO+Mrg70/9sKzZbAbH0EH6ceVtAbrLTap6f09Cw6pJiZw1kZmleQU
Nrs+TioE44GKFFhL1putIDB1pcZL3ENDuQE6nWy9pOwfhbNIceo3yr7F1dLfIw3l
NUFgi1UcGMqeSQFbXtrGMZWNGzhPXeZyz2S/P+6Tai9esJ1dgXY862YMIG3W/JMQ
bezvCXhTKa6OIF843krLGZRsSGVIaN53DqsQI86tGtOhUGE5Rzm3Rdj9cw5frBB9
VWYDmYr957CZjdTFVwCbnTW39JKPkcY2UoHff63nNY4Uy7Q5V+hLkrS09SOk2UxU
x8p9clIO2w3lRNAaTEkh
=kvtP
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ