[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 28 Jun 2011 20:53:41 +0200
From: Petr Matousek <pmatouse@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request: qemu-kvm: OOB memory access caused by negative vq
notifies
The virtio_queue_notify() function checks that the virtqueue number is
less than the maximum number of virtqueues. A signed comparison is
used but the virtqueue number could be negative if a buggy or malicious
guest is run. This results in memory accesses outside of the virtqueue
array.
To trigger this issue the attacker needs to issue 32bit write to Queue
Notify field of Virtio Header in the virtio pci config space even though
the field is 16bit only by specs. Qemu-kvm allows that for the moment
and provides whole 32bit value to the underlying functions.
Unprivileged guest user could use this flaw to crash the guest (denial
of service) or, possibly, escalate their privileges on the host.
Upstream patch:
http://patchwork.ozlabs.org/patch/94604/
References:
https://bugzilla.redhat.com/show_bug.cgi?id=717399
http://patchwork.ozlabs.org/patch/94604/
Thanks,
--
Petr Matousek / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
