[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 20 Sep 2016 15:08:34 -0400 (EDT)
From: cve-assign@...re.org
To: ppandit@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, liqiang6-s@....cn
Subject: Re: CVE Request Qemu: usb: xhci memory leakage during device unplug
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> Quick Emulator(Qemu) built with the USB xHCI controller emulation support is
> vulnerable to a memory leakage issue. It could occur while doing a USB device
> unplug operation; Doing so repeatedly would result in leaking host memory,
> affecting other services on the host.
>
> A privileged user inside guest could use this flaw to cause a DoS on the host
> and/or potentially crash the Qemu process instance on the host.
>
> https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg02773.html
> http://git.qemu.org/?p=qemu.git;a=commit;h=b53dd4495ced2432a0b652ea895e651d07336f7e
>
> If the xhci uses msix, it doesn't free the corresponding
> memory, thus leading a memory leak. This patch avoid this.
Use CVE-2016-7466.
- --
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJX4YgUAAoJEHb/MwWLVhi2ggQP/2DNMvmdNLOKphMe5SZwN1OG
pYSTUN1hLW4abmL3deZExJCf/zVnF70tCcussvYPVi2TvheXLefPBeuMVoUAktm1
1CdkDzpdQf/C+Ht48c2W/dh5LVvT90/ZQR/t7rKfttcM8efHjWFnCoYsgewyrTbv
iZyVKCHG1Ww0Mobjh19eLKgwymCAF4fjT5bY8IItwCyNOXfj+MiKh4lH31Ja3RBw
7jfJFfxRjjUippAukxuZ70EOlyGPxWO8Ln6/w2NVHYNPWKzjakc+8vXlv7bZi0bZ
boJOPrVeoyGoQsoqDwshfOv7TSmvz2edCvn9zbL2I07Je8tn4goY02MLB0sxOS89
dlasZ0MPEsmG+OrtDKDQ8C+tPAkXZ9egbFitp+bPSiFB8cLN3LyE99vhzIVe+IEZ
jizMhnbGOpmLyXjDb7CfoCoZXbOxD4KHaSpLj1kS+tCdyWTRANoRccOVgMNOEnXL
3568h8XWTLQ3tyUwEuRqeTSu889iBM453JwSGvWYxC8wyBHxI64uXddwsfHqrljF
nM++SLFhiVouccTBOdG5My7KBoRKlK5nQ0/stiXU9ACFPuLnnbR+iDqrdBwEW6jR
ycD6fgB3i0c6NXs17pWBGQup89UPpJjdEYFiukr1g0dUIH0u1Adf7EuzW9U+amJq
QqiwCA/ontAPMEBeCNxA
=RuAu
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
