[<prev] [next>] [day] [month] [year] [list]
Message-ID: <alpine.LFD.2.10.1405131612090.7354@wniryva.cad.erqung.pbz>
Date: Tue, 13 May 2014 16:16:25 +0530 (IST)
From: P J P <ppandit@...hat.com>
To: oss security list <oss-security@...ts.openwall.com>
Subject: CVE-2014-0222 Qemu: qcow1: Validate L2 table size
Hello,
'CVE-2014-0222' has been assigned to this issue.
Too large L2 table sizes cause unbounded allocations. Images actually
created by qemu-img only have 512 byte or 4k L2 tables.
To keep things consistent with cluster sizes, allow ranges between 512
bytes and 64k (in fact, down to 1 entry = 8 bytes is technically
working, but L2 table sizes smaller than a cluster don't make a lot of
sense).
This also means that the number of bytes on the virtual disk that are
described by the same L2 table is limited to at most 8k * 64k or 2^29,
preventively avoiding any integer overflows.
Upstream fix:
-------------
-> https://lists.gnu.org/archive/html/qemu-devel/2014-05/msg02155.html
Thank you.
--
Prasad J Pandit / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
