oss-security - CVE-2019-13164 Qemu: qemu-bridge-helper ACL bypassed with long interface names

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <nycvar.YSQ.7.76.1907030056560.11695@xnncv>
Date: Wed, 3 Jul 2019 01:01:36 +0530 (IST)
From: P J P <ppandit@...hat.com>
To: oss security list <oss-security@...ts.openwall.com>
cc: Riccardo Schirone <rschiron@...hat.com>
Subject: CVE-2019-13164 Qemu: qemu-bridge-helper ACL bypassed with long
 interface names

   Hello,

It was discovered that the Access Control List (ACL) implemented by 
qemu-bridge-helper program could be bypassed in particular case when the 
bridge interface names are as long as IFNAMSIZ-1, ie 15 characters. If the ACL 
specified in the /etc/qemu/bridge.conf file denies access to a bridge 
interface with name IFNAMSIZ-1 bytes long, but it allows all other interfaces. 
It is possible for a local attacker to use qemu-bridge-helper to create a tap 
device and attach it to a denied bridge interface, thus bypassing the ACL. 
This could be used by the attacker to get access to confidential data 
transmitted on the bridge.

Upstream patch:
---------------
   -> https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg00245.html

This issue was discovered by Riccardo Schirone of Red Hat Inc.

Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.