oss-security - CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mode

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 30 Nov 2015 14:35:14 +0530 (IST)
From: P J P <ppandit@...hat.com>
To: oss security list <oss-security@...ts.openwall.com>
cc: Qinghao Tang <luodalongde@...il.com>, Liu Ling <liuling-it@....cn>
Subject: CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback
 mode

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

   Hello,

The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving packets from a 
remote host(non-loopback mode), fails to validate the received data size, thus 
resulting in a buffer overflow issue. It could potentially lead to arbitrary 
code execution on the host, with privileges of the Qemu process. It requires 
the guest NIC to have larger MTU limit.

A remote user could use this flaw to crash the guest instance resulting in DoS 
or potentially execute arbitrary code on a remote host with privileges of the 
Qemu process.

Upstream fix:
- -------------
   -> https://lists.gnu.org/archive/html/qemu-devel/2015-11/msg06341.html

CVE-2015-7512 has been assigned to this issue by Red Hat Inc.

This issue was independently discovered by Ling Liu of Qihoo 360 Inc. and 
Jason Wang of Red Hat Inc.

Thank you.
- --
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJWXBFKAAoJEN0TPTL+WwQfTU8QAKPQfjNgSOI4C/Kh+LCQKQJn
vOt9sAShWauYW/rVrNhMp9j3fV8+h5NX8/l3MkHhHIa/+NiDxdfKQWAdfbQp18iI
rB10ccI95j+vzbcj56klwkW21dPHN1Tm1mvUOTmuB1pBEAmvFQiwcoZHxf8V0hsQ
FzOdG6iyqVDpW07vim3/imOSzdBXLUppth3TioTfZvvVLkHoSanADaAj8ntXm6r2
MqdZU12rWJJaixp8K5lKM8JdBzCCxhvdYTPp6WIXLztB8HvGJAG36wSzzxa/WoTw
GZMB8hpzjUJxWTRM9BQcd84gTeEe2Ow71AqU2cN10pKwgJEiDFHIpoOxnAs39WcA
i9LGS/z+NYx1b/5htT9qYbDt1cpd5T79ZwIcn52gCQaDg8zli9bpdT9Zh7kXIEWD
gTquq6pJXouERaXEIRhj3DcEc3PSRohO9p/hMS7ftJDLc7gJ5FBjr8xTld4CxTrc
AD+s1tHNfMxyxxS9bgnujW1UwuBE6hs1dQsa4zdWqEZf9dPts3IeuB+dfArm0rlk
m1EF9/71a0ug4SH0M4vdqBfBto40kSSZcor4zj+qJWMfJdfRBS8BvKvu9PNxuuc/
4EGKK77ECX5scwom5h02Zt2FHx01K1B+MQCHtnwFnTIM7kS+mbZuN4aj6EO5k+qg
olWvyKLp2Q1RnQWUwJh/
=ht+0
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.