Bug 2537752

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in libslirp. The NC-SI OEM response handler (ncsi_rsp_handler_oem() in src/ncsi.c) reads and reflects the 4-byte mfr_id field from the incoming NC-SI OEM command packet into the outgoing response before validating that the packet is large enough to contain that field. ncsi_input() only validates pkt_len against the 16-byte NC-SI common header (the fix scope of CVE-2020-29129), leaving the OEM sub-dispatch path, added afterward, unchecked. A guest capable of sending a crafted 30-33 byte NC-SI OEM Ethernet frame (ethertype 0x88F8) can cause up to 4 bytes of adjacent host RX-buffer memory to be disclosed back to the guest in the NC-SI response; if the instance is configured with a Mellanox manufacturer ID, a second handler (ncsi_rsp_handler_oem_mlx()) similarly over-reads up to 4 additional bytes from cmd->data. This is a guest-triggerable, bounded host memory disclosure; there is no write and no code execution.