Bug 698906 (CVE-2011-1750)

Summary: CVE-2011-1750 virtio-blk: heap buffer overflow caused by unaligned requests
Product: [Other] Security Response Reporter: Petr Matousek <pmatouse>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: amit.shah, berrange, bressers, dwmw2, ehabkost, itamar, jaswinder, jforbes, jrusnack, knoel, mkenneth, ondrejj, scottt.tw, tburke, virt-maint, virt-maint
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-07-29 12:40:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 698909, 698910, 698911    
Bug Blocks:    

Description Petr Matousek 2011-04-22 08:50:40 UTC 
It was found that virtio-blk driver in qemu-kvm did not properly validate 
read and write requests from the guest. A privileged guest user could use
this flaw to cause heap corruption, causing the guest to crash (denial of
service) or, possibly, resulting in the privileged guest user escalating
their privileges on the host.

On RHEL ExecShield (glibc heap/memory checks) mitigates this issue.

References:
http://www.spinics.net/lists/kvm/msg51877.html

Upstream commit:
http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=commit;h=52c050236eaa4f0b5e1d160cd66dc18106445c4d
Comment 4 Petr Matousek 2011-04-22 08:58:07 UTC 
Created qemu tracking bugs for this issue

Affects: fedora-all [bug 698911]
Comment 7 errata-xmlrpc 2011-05-19 13:02:41 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0534 https://rhn.redhat.com/errata/RHSA-2011-0534.html
Comment 8 Petr Matousek 2012-03-30 17:34:17 UTC 
Statement:

This issue does not affect versions of kvm package as shipped with Red Hat
Enterprise Linux 5.
Comment 9 Fedora Update System 2012-06-07 23:06:38 UTC 
qemu-0.14.0-9.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.