Bug 1132956 (CVE-2014-5388)

Summary: CVE-2014-5388 Qemu: out of bounds memory access
Product: [Other] Security Response Reporter: Prasad Pandit <ppandit>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: amit.shah, areis, berrange, bsarathy, cfergeau, dwmw2, ehabkost, gmollett, itamar, jrusnack, knoel, mkenneth, mrezanin, mtosatti, pbonzini, ppandit, rbalakri, rhod, rjones, scottt.tw, stefanha, virt-maint, virt-maint
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-12-08 11:29:15 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1132962, 1132964, 1132967    
Bug Blocks: 1132315    

Description Prasad Pandit 2014-08-22 12:42:35 UTC
An out of bounds memory access flaw was found in Qemu's ACPI PCI hotplug
interface. It leads to Qemu's memory corruption via OOB write(4 bytes) and 
information disclosure(~12 bytes) through OOB read.

A user with a custom PCI device could use this flaw to leak qemu process'
memory bytes or corrupt them on the host.

Upstream fix:
-------------
  -> https://lists.gnu.org/archive/html/qemu-devel/2014-08/msg03338.html

Comment 1 Prasad Pandit 2014-08-22 12:51:25 UTC
Statement:

This issue does not affect the versions of kvm package as shipped with Red Hat
Enterprise Linux 5.

This issue does not affect the versions of qemu-kvm package as shipped with Red Hat Enterprise Linux 6 and 7.

Comment 3 Murray McAllister 2014-08-25 05:50:46 UTC
MITRE assigned CVE-2014-5388 to this issue:

http://seclists.org/oss-sec/2014/q3/440

Comment 4 Prasad Pandit 2014-08-25 06:05:45 UTC
Acknowledgement:

Red Hat would like to thank Michael S. Tsirkin for reporting this issue.

Comment 5 Fedora Update System 2014-09-23 05:07:40 UTC
qemu-2.1.1-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.