Bug 1321972 (CVE-2016-3077)

Summary: CVE-2016-3077 ovirt-engine: Crash of API when parsing unxepected version number
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: alonbl, bmcclain, dblechte, eedri, gklein, juan.hernandez, lsurette, mgoldboi, michal.skrivanek, nobody, rbalakri, Rhev-m-bugs, sherold, yeylon, ykaul, ylavi
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-04-13 07:33:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1311616, 1321974, 1321975    
Bug Blocks:    

Description Adam Mariš 2016-03-29 13:38:09 UTC 
It was found that parsing complicated kernel version numbers leads to array index out-of-bounds exception in VersionMapper.fromKernelVersionString method. A malicious user with access to VM could configure it so that it reports a version number that causes API to crash. When the VM with crafted kernel version number is reported among with other VMs, the representation retrieving operation will fail also for all other VMs.

Product bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1311616
Comment 1 Adam Mariš 2016-03-29 13:38:46 UTC 
Created ovirt-engine-sdk-java tracking bugs for this issue:

Affects: fedora-all [bug 1321974]
Affects: epel-all [bug 1321975]
Comment 2 Juan Hernández 2016-03-29 13:45:11 UTC 
Consider closing this bug, as the issue doesn't affect any Fedora component, only the oVirt engine server side, which isn't part of fedora.