Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 29 Dec 2015 01:33:52 -0500 (EST)
From: cve-assign@...re.org
To: ppandit@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, luodalongde@...il.com
Subject: Re: CVE request Qemu net: rocker: fix an incorrect array bounds check

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> Qemu emulator built with the Rocker switch emulation support is vulnerable to
> an off-by-one error. It happens while processing transmit(tx) descriptors in
> 'tx_consume' routine, if a descriptor was to have more than allowed
> (ROCKER_TX_FRAGS_MAX=16) fragments.
> 
> A privileged user inside guest could use this flaw to cause memory leakage on
> the host or crash the Qemu process instance resulting in DoS issue.
> 
> https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.html
> https://bugzilla.redhat.com/show_bug.cgi?id=1286971

>> While processing transmit(tx) descriptors in 'tx_consume' routine
>> the switch emulator suffers from an off-by-one error, if a
>> descriptor was to have more than allowed(ROCKER_TX_FRAGS_MAX=16)
>> fragments. Fix an incorrect bounds check to avoid it.

Use CVE-2015-8701.

This is not yet available at
http://git.qemu.org/?p=qemu.git;a=history;f=hw/net/rocker/rocker.c but
that may be an expected place for a later update.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJWgiicAAoJEL54rhJi8gl5xgMP/0m/6rggx4QjsM1bvTzJxs6T
VyoOVeWKJVqO2qMtl0eHwhsQZty8O26Qbyewqvt13551IjbYxbvHLZzo/wwN1b16
oiQjdsjSZyR+Uw3GYLmmEf2Np1EvRsvAO+wqOzhJ1I/ktbrP1V1Z7Zi6pt2HHDmq
jQaPvHv4jjd00bvmO6zWvrAPQZlwK5IWhQsB3QM9zZOBik95q9N2VstM6lLzMu2U
VlGa0CHW7VUtOiN8Bw+iBFXyv8ZAgrOrtMbgIwt6EjlYefuNOrVFhp9EEvNONegW
mOaj6Xucm44gVGO0NkHcH6XILFwdESs7T57pvqLlDbCOhVSZpX/Xq9PO+ZqiI3AD
7EpbV6tye2GodfvLtxOu0WKaHAbZRKK9ynWo3zVCOcsHDmS864w4eZZexj+fGgsg
dpY3c9j+otN1J+bgRaNGvKapQ0LrJAffXMk5iTb4233KF0/SSnmAMbU46lI/Sn7d
E6PGoHkosmPPQvjaNLf3BOetzKSO7cQj9CJ1Uen2RsuTHlJ3FoyAdUs5nk33Z96z
wiiHTl7duEtslr3mHq6xwynbgfDyPvlnrchMS8Q8NBUf2fUnKiDK6zdsiH3s14dh
QA8F6eDCEIxqGyKM0UMAYiUTcejx0NtZ5TFSTR5LCx+CmSbtm2wJhBiGOz4r797b
iCXQR5QRr2Ml8Zq6nk8/
=idCx
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ