oss-sec mailing list archives
CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mode
From: P J P <ppandit () redhat com>
Date: Mon, 30 Nov 2015 14:35:14 +0530 (IST)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello,The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving packets from a remote host(non-loopback mode), fails to validate the received data size, thus resulting in a buffer overflow issue. It could potentially lead to arbitrary code execution on the host, with privileges of the Qemu process. It requires the guest NIC to have larger MTU limit.
A remote user could use this flaw to crash the guest instance resulting in DoS or potentially execute arbitrary code on a remote host with privileges of the Qemu process.
Upstream fix: - ------------- -> https://lists.gnu.org/archive/html/qemu-devel/2015-11/msg06341.html CVE-2015-7512 has been assigned to this issue by Red Hat Inc.This issue was independently discovered by Ling Liu of Qihoo 360 Inc. and Jason Wang of Red Hat Inc.
Thank you. - -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJWXBFKAAoJEN0TPTL+WwQfTU8QAKPQfjNgSOI4C/Kh+LCQKQJn vOt9sAShWauYW/rVrNhMp9j3fV8+h5NX8/l3MkHhHIa/+NiDxdfKQWAdfbQp18iI rB10ccI95j+vzbcj56klwkW21dPHN1Tm1mvUOTmuB1pBEAmvFQiwcoZHxf8V0hsQ FzOdG6iyqVDpW07vim3/imOSzdBXLUppth3TioTfZvvVLkHoSanADaAj8ntXm6r2 MqdZU12rWJJaixp8K5lKM8JdBzCCxhvdYTPp6WIXLztB8HvGJAG36wSzzxa/WoTw GZMB8hpzjUJxWTRM9BQcd84gTeEe2Ow71AqU2cN10pKwgJEiDFHIpoOxnAs39WcA i9LGS/z+NYx1b/5htT9qYbDt1cpd5T79ZwIcn52gCQaDg8zli9bpdT9Zh7kXIEWD gTquq6pJXouERaXEIRhj3DcEc3PSRohO9p/hMS7ftJDLc7gJ5FBjr8xTld4CxTrc AD+s1tHNfMxyxxS9bgnujW1UwuBE6hs1dQsa4zdWqEZf9dPts3IeuB+dfArm0rlk m1EF9/71a0ug4SH0M4vdqBfBto40kSSZcor4zj+qJWMfJdfRBS8BvKvu9PNxuuc/ 4EGKK77ECX5scwom5h02Zt2FHx01K1B+MQCHtnwFnTIM7kS+mbZuN4aj6EO5k+qg olWvyKLp2Q1RnQWUwJh/ =ht+0 -----END PGP SIGNATURE-----
Current thread:
- CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mode P J P (Nov 30)