Date: Fri, 18 Sep 2015 16:15:37 +0530 (IST) From: P J P <ppandit@...hat.com> To: oss security list <oss-security@...ts.openwall.com> cc: Jason Wang <jasowang@...hat.com> Subject: CVE request Qemu: net: virtio-net possible remote DoS Hello, Qemu emulator built with the Virtual Network Device(virtio-net) support is vulnerable to a DoS issue. It could occur while receiving large packets over the tuntap/macvtap interfaces and when guest's virtio-net driver did not support big/mergeable receive buffers. An attacker on the local network could use this flaw to disable guest's networking by sending a large number of jumbo frames to the guest, exhausting all receive buffers and thus leading to a DoS situation. Upstream fixes: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg04729.html -> https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg04730.html -> https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg04731.html [PATCH 3/3] above fixes this issue by discarding the used descriptors. Thank you. -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.