Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 26 Sep 2013 12:39:10 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: qemu host crash from within guest

Could a CVE be assigned to the following?

A dangling pointer access flaw was found in the way qemu handled
hot-unplugging virtio devices.  This flaw was introduced by virtio
refactoring and exists in the virtio-pci implementation.  When the
virtio-blk-pci device is deleted, the virtio-blk-device is removed first
(removal is done in post-order).  Later, the virtio-blk-device is
accessed again, but proxy->vdev->vq is no longer valid (a dangling
pointer) and kvm_set_ioeventfd_pio fails.

A privileged guest user could use this flaw to crash the qemu process on
the host system, causing a denial of service to it and any other running
virtual machines.

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1012633
http://thread.gmane.org/gmane.comp.emulators.qemu/234440

-- 
Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.