oss-security - CVE-2010-0741 qemu: Improper handling of erroneous data provided by Linux virtio-net driver

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 29 Mar 2010 14:36:42 +0200 (CEST)
From: Petr Matousek <pmatouse@...hat.com>
To: oss-security@...ts.openwall.com
cc: coley@...us.mitre.org
Subject: CVE-2010-0741 qemu: Improper handling of erroneous data provided by
 Linux virtio-net driver

Hello vendors,

    Josh Bressers has assigned a CVE id CVE-2010-0741 to the following bug:

A flaw was found in the way the QEMU-KVM handled erroneous data provided 
by the guest Linux virtio-net driver. Due deficiency in the implementation 
of the TSO (TCP segment offloading), the guest's virtio-net driver 
transmitted improper data to the particular QEMU-KVM process on the host, 
resulting in its termination. A remote attacker could use this flaw to 
cause denial of service (guest crash) by sending certain, 
specially-crafted data to arbitrary open port on the target guest system.

A remote attacker could exploit this to crash guests which use virtio
networking on Linux kernels earlier than 2.6.26.

Note that this was previously reported in Canonical's launchpad but no CVE 
name was ever assigned AFAIK.

References:
-----------
https://bugzilla.redhat.com/show_bug.cgi?id=577218
https://patchwork.kernel.org/patch/56479/
https://bugs.edge.launchpad.net/ubuntu/+source/qemu-kvm/+bug/458521
http://lists.gnu.org/archive/html/qemu-devel/2009-10/msg02480.html

Upstream patch:
---------------
http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=commit;h=184bd0484533b725194fa517ddc271ffd74da7c9

Thanks && Regards, Petr.
--
Petr Matousek / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.