[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 29 Jan 2016 20:13:23 -0500 (EST)
From: cve-assign@...re.org
To: ppandit@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, zuozhi.fzz@...baba-inc.com
Subject: Re: CVE request Qemu: ide: ahci null pointer dereference when using FIS CLB engines
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> Qemu emulator built with an IDE AHCI emulation support is vulnerable to a null
> pointer dereference flaw. It occurs while unmapping the Frame Information
> Structure(FIS) & Command List Block(CLB) entries.
>
> A privileged user inside guest could use this flaw to crash the Qemu process
> instance resulting in DoS.
>
> https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05742.html
> https://bugzilla.redhat.com/show_bug.cgi?id=1302057
>> ide: ahci: add check before calling dma_memo
>> address_space_map() returns NULL because 'bounce.buffer' is in use
Use CVE-2016-2197.
This is not yet available at
http://git.qemu.org/?p=qemu.git;a=history;f=hw/ide/ahci.c but
that may be an expected place for a later update.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJWrAyZAAoJEL54rhJi8gl54p0QAK4MPiZJk06Dm60yZcoDkz2k
AOnEE+vnHrYgD0pv3gNrtN5r7m3Aqo0FnDv9O+MlRy35ZouAnp5M5FcMhLCSnxyi
5py9FNW0VMOSz45y7oXFv50SOtbHO63uRf5ZUGc1Sbb2gWFVZuYdZMy1MByZ38lO
BEwBmrhDHHa7v1VEwA0avC+ur4H8IZeVv0o16IdgrkbJ3HMOq+mdH8wZVhiiQykK
sR7K4u/iGk3ZV1Jn9Cf9YGtxArFQCYeN58kNQ9SyH5oe2ZnoGnub3ovB7V00ReiU
E+cbPRTwByJyIE/5kOhDHUOV32CnRmkNwWW0g4ZiaROtsQY95gC6+VzASzrAahsY
igG+FuW2YV98opbtqegVixPHeYN5SJu/DIQKJEolPqpNeGs8tNYrhmtShgm95ZJc
K4LrPuNwmg4ZNCFuAGQB6bKzvddh9zutj9Eui5xeuzWd9cXWCJV8F2RHAVtYZZKM
T2WedId8Bu5OstqMCPRQjFMnlMPiajqSdrot0hUAtLds1/EI+iWu0mXaq1fmTxY4
qOtz7GzFWx5xQ+ZRlZj6W3J9dsN74w6xG94vle/bWYLxp646oYBfyMk2nBI4hW3m
XjoUe09njgFRNFDzFJK9uj//qirsPRN2c14RamCN8y65bFKQ4rpopjW26VQwBNJJ
IpC8cX/RD1LvEnWkxF8L
=Huqy
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
