Date: Thu, 26 Sep 2013 12:39:10 -0600 From: Vincent Danen <vdanen@...hat.com> To: oss-security@...ts.openwall.com Subject: CVE request: qemu host crash from within guest Could a CVE be assigned to the following? A dangling pointer access flaw was found in the way qemu handled hot-unplugging virtio devices. This flaw was introduced by virtio refactoring and exists in the virtio-pci implementation. When the virtio-blk-pci device is deleted, the virtio-blk-device is removed first (removal is done in post-order). Later, the virtio-blk-device is accessed again, but proxy->vdev->vq is no longer valid (a dangling pointer) and kvm_set_ioeventfd_pio fails. A privileged guest user could use this flaw to crash the qemu process on the host system, causing a denial of service to it and any other running virtual machines. References: https://bugzilla.redhat.com/show_bug.cgi?id=1012633 http://thread.gmane.org/gmane.comp.emulators.qemu/234440 -- Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.