[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 13 May 2014 15:56:14 +0530 (IST)
From: P J P <ppandit@...hat.com>
To: oss security list <oss-security@...ts.openwall.com>
Subject: CVE request: Qemu: usb: fix up post load checks
Hello,
Correct post load checks:
1. dev->setup_len == sizeof(dev->data_buf)
seems fine, no need to fail migration
2. When state is DATA, passing index > len
will cause memcpy with negative length,
resulting in heap overflow
An user able to alter the saved VM data(either on the disk or over the wire
during migration) could use this flaw to to corrupt QEMU process memory on the
(destination) host, which could potentially result in arbitrary code execution
on the host with the privileges of the QEMU process.
Upstream fix:
-------------
-> http://article.gmane.org/gmane.comp.emulators.qemu/272322
Thank you.
--
Prasad J Pandit / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
