Bug 1893895 (CVE-2020-25707)
| Summary: | CVE-2020-25707 QEMU: infinite loop in e1000e_write_packet_to_guest() in hw/net/e1000e_core.c | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Mauro Matteo Cascella <mcascell> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED DUPLICATE | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | ailan, amit, berrange, carnil, cfergeau, dbecker, drjones, dwmw2, imammedo, itamar, jen, jferlan, jforbes, jjoyce, jmaloy, jschluet, knoel, lhh, lkundrak, lpeer, m.a.young, mburns, mkenneth, mrezanin, mst, pbonzini, ribarry, rjones, robinlee.sysu, sclewis, slinaber, virt-maint, virt-maint, vkuznets, xen-maint |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | qemu 5.2.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
An infinite loop flaw was found in the e1000e NIC emulation code of QEMU. This issue occurs in the e1000e_write_packet_to_guest() routine while processing bogus RX descriptor data transmitted by the guest. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-12-14 14:11:32 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1895051, 1895052, 1895404, 1895405, 1895407, 1895411, 1903070, 1903071, 1910663 | ||
| Bug Blocks: | 1892339 | ||
|
Description
Mauro Matteo Cascella
2020-11-02 22:13:32 UTC
Created qemu tracking bugs for this issue: Affects: fedora-all [bug 1895051] Hi It looks there is upstream this old commit: https://git.qemu.org/?p=qemu.git;a=commit;h=4154c7e03fa55b4cf52509a83d50d6c09d743b77 But this would be fixed upstream since v2.9.0-rc0. Is this CVE related to this fix? Regards, Salvatore (In reply to Salvatore Bonaccorso from comment #8) > Hi > > It looks there is upstream this old commit: > > https://git.qemu.org/?p=qemu.git;a=commit; > h=4154c7e03fa55b4cf52509a83d50d6c09d743b77 > > But this would be fixed upstream since v2.9.0-rc0. > > Is this CVE related to this fix? OTOH, this would be CVE-2017-9310 so I assume it is something different? Regards, Salvatore Okay I guess https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg03552.html might be the better answer here. Is this correct? Hi Salvatore, In reply to comment #10: > Okay I guess > https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg03552.html might > be the better answer here. Is this correct? Correct, this is different from CVE-2017-9310 although somewhat related. I will add a reference to the patch here, once it gets accepted upstream. Regards, Mauro Hi Mauro Thanks a lot for the confirmation! Regards, Salvatore Acknowledgments: Name: Cheolwoo Myung, Gaoning Pan (Zhejiang University) Statement: This flaw was found to be a duplicate of CVE-2020-28916. Please see https://access.redhat.com/security/cve/CVE-2020-28916 for information about affected products and security errata. *** This bug has been marked as a duplicate of bug 1903064 *** This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1762 https://access.redhat.com/errata/RHSA-2021:1762 |