Re: Possible CVE request: virtualbox virtio-net host DoS

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/05/2013 04:13 AM, Raphael Geissert wrote:
> Hi,
>
> Quoting [1]:
> > I have discovered a problem with virtio-net that leads to a
> > lockup of the host machine's kernel and the need for a hard reset
> > to make it working again.
>
> The bug is said to be worked around in version 4.2.14 and really
> fixed in 4.2.16, but the changelog of either version doesn't
> reference that ticket.
>
> Rumors say that virtualbox makes the host randomly hang, but since 
> there is an actual bug report and confirmation from upstream this
> time I guess a CVE id should be assigned.
>
> [1] https://www.virtualbox.org/ticket/11863 [2]
> https://www.virtualbox.org/wiki/Changelog [3]
> https://secunia.com/advisories/53858/
>
> Cheers, -- Raphael Geissert - Debian Developer www.debian.org -
> get.debian.net

Oracle is a CNA so they should handle this:

http://cve.mitre.org/cve/cna.html

CC'ing them. Can you guys assign one quickly so this can be properly
tracked? Thanks!

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJR1xzlAAoJEBYNRVNeJnmTrrsQALVz10X3jeJXJwZ+Zv5lRsJ9
GRwxUqpMiRnE1ruslEQYsapH5+AWF5i9PQe10RYGyZP3HMBxPFj+4SYYgNRHjJqI
5KI3BSmpxwX4nvr6J5OvZpfrclfM/Xk/jEDJv7Ixz6//qi/IfrGn7ybBoQqanJ+T
Fo18/HyDRHoykS4w5C1zaXtidgM+32kB+8UQKa31A8wsYbZQs58UybGZGGfFX3Ye
3C24KZp/PFKqtnT1HixNpsOvZIW8WoviYuViz16MJrAGmieZj/yozTrVeN+T/eZb
omDdXknUvXr11ZBK7oyPTM4qL1jkSXL6ECPTiI0h+jBccRvavpf6jtpJZC/ANZyA
pi1BxU0sb1+5B6aXPdmFgIpZzXwjUyBybpCXkJ4DdLkjoriExa8uRNe5FXes+RAr
d4iRwxr0tbXIaEyUHWpor8KCTZWBWxVT++lnjgIIFoA3lfEZ+4DGxUugey2QscJF
Px3xbp8+AAAuGqUgf03W3IWyYzjlTmMjnut1vcc/BwbtVVtnaLcHgv9sPhjrmCj6
tRJjCC1gU+BU+b8EF1sRfFqeAb79NZ709xFOAUau0WYb1kR18XCKDGBgmkmBm3ki
xLWaBdToIX7T8LkOKQGReunVXqJdBu2mYruYf3X3Bu5koJDtuUUzbqqJDgGbTYNn
E2Ue0NhUPbQZMw379XEE
=O5Fn
-----END PGP SIGNATURE-----