It was found that the QEMU's websocket frame decoder processed incoming frames without limiting resources used to process the header and payload. An attacker able to access a guest's VNC console could use this flaw to trigger a denial of service on the host by exhausting all available memory and CPU. Acknowledgements: This issue was discovered by Daniel P. Berrange of Red Hat.
Created attachment 998931 [details] 0001-CVE-2015-1779-incrementally-decode-websocket-frames.patch
Created attachment 998932 [details] 0002-CVE-2015-1779-limit-size-of-HTTP-headers-from-websoc.patch
Created attachment 999785 [details] 0001-CVE-2015-1779-incrementally-decode-websocket-frames.patch
Created attachment 999786 [details] 0002-CVE-2015-1779-limit-size-of-HTTP-headers-from-websoc.patch
Statement: This issue did not affect the kvm and qemu-kvm packages as shipped with Red Hat Enterprise Linux 5 and 6.
Patches now posted publically upstream at: https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04894.html
Created qemu tracking bugs for this issue: Affects: fedora-all [bug 1205051]
Upstream patches: http://git.qemu.org/?p=qemu.git;a=commit;h=a2bebfd6e09d http://git.qemu.org/?p=qemu.git;a=commit;h=2cdb5e142fb93 Please note that the first patch committed to QEMU project git is slightly different than the proposed patches (includes fix for a regression).
qemu-2.3.0-0.3.rc2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products: RHEV-H and Agents for RHEL-7 Via RHSA-2015:1931 https://rhn.redhat.com/errata/RHSA-2015-1931.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:1943 https://rhn.redhat.com/errata/RHSA-2015-1943.html