Bug 1368990 (CVE-2016-6834)

Summary:	CVE-2016-6834 Qemu: net: vmxnet3: an infinite loop during packet fragmentation
Product:	[Other] Security Response	Reporter:	Prasad Pandit <ppandit>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ailan, amit.shah, apevec, areis, ayoung, berrange, cfergeau, chrisw, cvsbot-xmlrpc, drjones, dwmw2, imammedo, itamar, jen, jschluet, kbasil, knoel, lhh, lpeer, markmc, m.a.young, mkenneth, mrezanin, mst, pbonzini, rbryant, rjones, rkrcmar, sclewis, srevivo, tdecacqu, virt-maint, virt-maint, vkuznets, xen-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 02:57:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1368991
Bug Blocks:	1330535

Description Prasad Pandit 2016-08-22 09:51:37 UTC

Quick Emulator(Qemu) built with the VMWARE VMXNET3 NIC device support,
with network abstraction layer is vulnerable to an infinite loop issue.
It could occur while fragmenting packets in the device.

A privileged user inside guest could use this flaw to crash the Qemu instance
resulting in DoS.

Upstream patch:
---------------
  -> http://git.qemu.org/?p=qemu.git;a=commit;h=ead315e43ea0c2ca3491209c6c8db8ce3f2bbe05

Reference:
----------
  -> http://www.openwall.com/lists/oss-security/2016/08/18/7

Comment 1 Prasad Pandit 2016-08-22 09:52:11 UTC

Acknowledgments:

Name: Li Qiang (Qihoo 360 Inc.)

Comment 2 Prasad Pandit 2016-08-22 09:53:07 UTC

Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1368991]