Bug 1157641 (CVE-2014-7815)

Summary:	CVE-2014-7815 qemu: vnc: insufficient bits_per_pixel from the client sanitization
Product:	[Other] Security Response	Reporter:	Petr Matousek <pmatouse>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amit.shah, areis, berrange, carnil, cfergeau, dwmw2, ehabkost, itamar, jen, knoel, kraxel, mkenneth, mrezanin, mtosatti, pbonzini, pmatouse, rbalakri, rjones, rpacheco, scottt.tw, stefanha, virt-maint, virt-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	An uninitialized data structure use flaw was found in the way the set_pixel_format() function sanitized the value of bits_per_pixel. An attacker able to access a guest's VNC console could use this flaw to crash the guest.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-09-18 11:58:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1157644, 1157645, 1157646, 1157647
Bug Blocks:	1156529

Description Petr Matousek 2014-10-27 12:13:15 UTC

bits_per_pixel that are less than 8 could result in accessing
non-initialized buffers later in the code due to the expectation
that bytes_per_pixel value that is used to initialize these buffers is
never zero.

An attacker having access to the guest's VNC console could use this
flaw to crash the guest.

Acknowledgements:

Red Hat would like to thank James Spadaro of Cisco for reporting this issue.

Comment 1 Petr Matousek 2014-10-27 12:15:21 UTC

Upstream patch submission:

http://lists.gnu.org/archive/html/qemu-devel/2014-10/msg03210.html

Comment 2 Petr Matousek 2014-10-27 12:16:13 UTC

Statement:

This issue did not affect the kvm package as shipped with Red Hat Enterprise
Linux 5. Future qemu-kvm updates for Red Hat Enterprise Linux 6 and 7 may address this issue.

Comment 5 Petr Matousek 2014-10-27 12:17:54 UTC

Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1157647]

Comment 6 Gerd Hoffmann 2014-11-03 08:01:52 UTC

upstream commit e6908bfe8e07f2b452e78e677da1b45b1c0f6829

Comment 9 Fedora Update System 2014-11-10 06:22:17 UTC

qemu-2.1.2-6.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2014-11-10 06:48:02 UTC

qemu-1.6.2-10.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 errata-xmlrpc 2015-03-05 08:12:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:0349 https://rhn.redhat.com/errata/RHSA-2015-0349.html

Comment 12 errata-xmlrpc 2015-03-05 09:56:58 UTC

This issue has been addressed in the following products:

  RHEV-H and Agents for RHEL-7

Via RHSA-2015:0624 https://rhn.redhat.com/errata/RHSA-2015-0624.html