Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 29 Jan 2016 20:13:23 -0500 (EST)
From: cve-assign@...re.org
To: ppandit@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, zuozhi.fzz@...baba-inc.com
Subject: Re: CVE request Qemu: ide: ahci null pointer dereference when using FIS CLB engines

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> Qemu emulator built with an IDE AHCI emulation support is vulnerable to a null
> pointer dereference flaw. It occurs while unmapping the Frame Information
> Structure(FIS) & Command List Block(CLB) entries.
>
> A privileged user inside guest could use this flaw to crash the Qemu process
> instance resulting in DoS.
>
> https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05742.html
> https://bugzilla.redhat.com/show_bug.cgi?id=1302057

>> ide: ahci: add check before calling dma_memo

>> address_space_map() returns NULL because 'bounce.buffer' is in use

Use CVE-2016-2197.

This is not yet available at
http://git.qemu.org/?p=qemu.git;a=history;f=hw/ide/ahci.c but
that may be an expected place for a later update.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJWrAyZAAoJEL54rhJi8gl54p0QAK4MPiZJk06Dm60yZcoDkz2k
AOnEE+vnHrYgD0pv3gNrtN5r7m3Aqo0FnDv9O+MlRy35ZouAnp5M5FcMhLCSnxyi
5py9FNW0VMOSz45y7oXFv50SOtbHO63uRf5ZUGc1Sbb2gWFVZuYdZMy1MByZ38lO
BEwBmrhDHHa7v1VEwA0avC+ur4H8IZeVv0o16IdgrkbJ3HMOq+mdH8wZVhiiQykK
sR7K4u/iGk3ZV1Jn9Cf9YGtxArFQCYeN58kNQ9SyH5oe2ZnoGnub3ovB7V00ReiU
E+cbPRTwByJyIE/5kOhDHUOV32CnRmkNwWW0g4ZiaROtsQY95gC6+VzASzrAahsY
igG+FuW2YV98opbtqegVixPHeYN5SJu/DIQKJEolPqpNeGs8tNYrhmtShgm95ZJc
K4LrPuNwmg4ZNCFuAGQB6bKzvddh9zutj9Eui5xeuzWd9cXWCJV8F2RHAVtYZZKM
T2WedId8Bu5OstqMCPRQjFMnlMPiajqSdrot0hUAtLds1/EI+iWu0mXaq1fmTxY4
qOtz7GzFWx5xQ+ZRlZj6W3J9dsN74w6xG94vle/bWYLxp646oYBfyMk2nBI4hW3m
XjoUe09njgFRNFDzFJK9uj//qirsPRN2c14RamCN8y65bFKQ4rpopjW26VQwBNJJ
IpC8cX/RD1LvEnWkxF8L
=Huqy
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ