Bug 2140567 (CVE-2022-3872)
| Summary: | CVE-2022-3872 QEMU: sdhci: buffer data port register off-by-one read/write | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Mauro Matteo Cascella <mcascell> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | ddepaula, eglynn, jen, jferlan, jjoyce, jmaloy, knoel, lhh, mburns, mgarciac, mkenneth, mrezanin, mst, pbonzini, spower, virt-maint, XRivenDell |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count == block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-12-04 09:02:54 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2140584, 2140585 | ||
| Bug Blocks: | 2087158 | ||
|
Description
Mauro Matteo Cascella
2022-11-07 09:33:47 UTC
Created qemu tracking bugs for this issue: Affects: epel-all [bug 2140585] Affects: fedora-all [bug 2140584] *** Bug 2083064 has been marked as a duplicate of this bug. *** (better) patch by Philippe Mathieu-Daudé: https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg01161.html This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-3872 Not yet merged upstream due to a CI failure: https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg01504.html |