[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130926183910.GK32193@redhat.com>
Date: Thu, 26 Sep 2013 12:39:10 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: qemu host crash from within guest
Could a CVE be assigned to the following?
A dangling pointer access flaw was found in the way qemu handled
hot-unplugging virtio devices. This flaw was introduced by virtio
refactoring and exists in the virtio-pci implementation. When the
virtio-blk-pci device is deleted, the virtio-blk-device is removed first
(removal is done in post-order). Later, the virtio-blk-device is
accessed again, but proxy->vdev->vq is no longer valid (a dangling
pointer) and kvm_set_ioeventfd_pio fails.
A privileged guest user could use this flaw to crash the qemu process on
the host system, causing a denial of service to it and any other running
virtual machines.
References:
https://bugzilla.redhat.com/show_bug.cgi?id=1012633
http://thread.gmane.org/gmane.comp.emulators.qemu/234440
--
Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
