[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 18 Sep 2015 16:15:37 +0530 (IST)
From: P J P <ppandit@...hat.com>
To: oss security list <oss-security@...ts.openwall.com>
cc: Jason Wang <jasowang@...hat.com>
Subject: CVE request Qemu: net: virtio-net possible remote DoS
Hello,
Qemu emulator built with the Virtual Network Device(virtio-net) support is
vulnerable to a DoS issue. It could occur while receiving large packets over
the tuntap/macvtap interfaces and when guest's virtio-net driver did not
support big/mergeable receive buffers.
An attacker on the local network could use this flaw to disable guest's
networking by sending a large number of jumbo frames to the guest, exhausting
all receive buffers and thus leading to a DoS situation.
Upstream fixes:
---------------
-> https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg04729.html
-> https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg04730.html
-> https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg04731.html
[PATCH 3/3] above fixes this issue by discarding the used descriptors.
Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
