Bug 1879801 (CVE-2020-25624)

Summary: CVE-2020-25624 QEMU: usb: hcd-ohci: out-of-bound access issue while processing transfer descriptors
Product: [Other] Security Response Reporter: Prasad Pandit <ppandit>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ailan, berrange, cfergeau, drjones, imammedo, itamar, jen, jferlan, jforbes, jmaloy, knoel, m.a.young, mkenneth, mrezanin, mst, ondrejj, pbonzini, philmd, ribarry, rjones, robinlee.sysu, virt-maint, virt-maint, vkuznets, xen-maint
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: QEMU 5.2.0 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in QEMU. An out-of-bounds read/write access issue was found in the USB OHCI controller emulator. This issue occurs while servicing transfer descriptors (TD), as the OHCI controller derives variables 'start_addr', 'end_addr', and 'len' from values supplied by the host controller driver. The host controller driver may supply values when using these variables, leading to an out-of-bounds access issue. This flaw allows a guest user or process to crash the QEMU process on the host, resulting in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2021-12-15 12:05:36 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1879802, 1879803, 1879805, 1910677    
Bug Blocks: 1867982    

Description Prasad Pandit 2020-09-17 05:14:19 UTC 
An out-of-bounds r/w access issue was found in the USB OHCI controller emulator of QEMU. It could occur while servicing transfer descriptors(TD), as OHCI controller derives variables 'start_addr', 'end_addr', 'len' etc. from values supplied by the host controller driver. Host controller driver may supply values such that using above variables leads to out-of-bounds access issues. A guest user/process may use this flaw to crash the QEMU process on the host resulting in DoS scenario.

Upstream patch:
---------------
  -> https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05492.html
Comment 1 Prasad Pandit 2020-09-17 05:14:27 UTC 
Acknowledgments:

Name: Gaoning Pan (Zhejiang university), Yongkang Jia (Zhejiang university), Yi Ren (Alibaba Cloud Intelligence Security Team)
Comment 2 Prasad Pandit 2020-09-17 05:15:09 UTC 
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1879802]


Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1879803]