Date: Mon, 10 Aug 2020 11:57:02 +0200 From: Mauro Matteo Cascella <mcascell@...hat.com> To: Michael Tokarev <mjt@....msk.ru> Cc: oss-security@...ts.openwall.com, Alexander Bulekov <alxndr@...edu>, ziming zhang <ezrakiez@...il.com> Subject: Re: CVE-2020-16092 QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c Hi Michael, On Mon, Aug 10, 2020 at 11:23 AM Michael Tokarev <mjt@....msk.ru> wrote: > > Hmm. Is it really worth the effort to treat these things as security > issues? There are so many ways to crash a machine (be it virtual or > hardware), there are definitely countless ways to crash things from > within privileged code.. what's the security impact of a hardware > issue when, say, a driver code in the OS does a stupid thing and > the hardware locks up? > I see your point. Our general assumption is to *not* consider assert() failures CVE worthy if they can only be triggered by privileged users . In this case specifically, given the assertion failure occurs while sending packets from the guest, we assumed it may be possible for an unprivileged guest user to cause a DoS scenario (e.g., by sending malicious/malformed network packets). In accordance with QEMU maintainers, we therefore decided to provide a fix for this bug. But again, I agree these kinds of issues tend to be questionable, so we typically proceed on a case-by-case basis.  https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg03869.html Thanks, -- Mauro Matteo Cascella, Red Hat Product Security 6F78 E20B 5935 928C F0A8 1A9D 4E55 23B8 BB34 10B0
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.