Bug 1199572 (CVE-2015-1779)
| Summary: | CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Martin Prpič <mprpic> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abaron, aortega, apevec, areis, ayoung, berrange, carnil, chrisw, dallan, ehabkost, gkotton, jen, jrusnack, knoel, lhh, lpeer, markmc, mrezanin, mst, mtosatti, pmatouse, rbalakri, rbryant, sclewis, security-response-team, virt-maint, yeylon |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
It was found that the QEMU's websocket frame decoder processed incoming frames without limiting resources used to process the header and the payload. An attacker able to access a guest's VNC console could use this flaw to trigger a denial of service on the host by exhausting all available memory and CPU.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-10-27 09:17:53 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1205050, 1205051, 1206497, 1206498, 1206499 | ||
| Bug Blocks: | 1199575 | ||
| Attachments: | |||
|
Description
Martin Prpič
2015-03-06 16:20:32 UTC
Created attachment 998931 [details]
0001-CVE-2015-1779-incrementally-decode-websocket-frames.patch
Created attachment 998932 [details]
0002-CVE-2015-1779-limit-size-of-HTTP-headers-from-websoc.patch
Created attachment 999785 [details]
0001-CVE-2015-1779-incrementally-decode-websocket-frames.patch
Created attachment 999786 [details]
0002-CVE-2015-1779-limit-size-of-HTTP-headers-from-websoc.patch
Statement: This issue did not affect the kvm and qemu-kvm packages as shipped with Red Hat Enterprise Linux 5 and 6. Patches now posted publically upstream at: https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04894.html Created qemu tracking bugs for this issue: Affects: fedora-all [bug 1205051] Upstream patches: http://git.qemu.org/?p=qemu.git;a=commit;h=a2bebfd6e09d http://git.qemu.org/?p=qemu.git;a=commit;h=2cdb5e142fb93 Please note that the first patch committed to QEMU project git is slightly different than the proposed patches (includes fix for a regression). qemu-2.3.0-0.3.rc2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. This issue has been addressed in the following products: RHEV-H and Agents for RHEL-7 Via RHSA-2015:1931 https://rhn.redhat.com/errata/RHSA-2015-1931.html This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:1943 https://rhn.redhat.com/errata/RHSA-2015-1943.html |