Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1199572 - (CVE-2015-1779) CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder
CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets dec...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20150323,repor...
: Security
Depends On: 1205050 1205051 1206497 1206498 1206499
Blocks: 1199575
  Show dependency tree / graph
 
Reported: 2015-03-06 11:20 EST by Martin Prpič
Modified: 2016-04-27 00:27 EDT (History)
27 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
It was found that the QEMU's websocket frame decoder processed incoming frames without limiting resources used to process the header and the payload. An attacker able to access a guest's VNC console could use this flaw to trigger a denial of service on the host by exhausting all available memory and CPU.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-10-27 05:17:53 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
0001-CVE-2015-1779-incrementally-decode-websocket-frames.patch (8.06 KB, text/plain)
2015-03-06 11:22 EST, Martin Prpič 		no flags Details
0002-CVE-2015-1779-limit-size-of-HTTP-headers-from-websoc.patch (2.22 KB, text/plain)
2015-03-06 11:22 EST, Martin Prpič 		no flags Details
0001-CVE-2015-1779-incrementally-decode-websocket-frames.patch (8.03 KB, text/plain)
2015-03-10 05:24 EDT, Martin Prpič 		no flags Details
0002-CVE-2015-1779-limit-size-of-HTTP-headers-from-websoc.patch (2.22 KB, text/plain)
2015-03-10 05:24 EDT, Martin Prpič 		no flags Details
Show Obsolete (2) Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1931 normal SHIPPED_LIVE Moderate: qemu-kvm-rhev security update 2015-10-26 21:22:29 EDT
Red Hat Product Errata RHSA-2015:1943 normal SHIPPED_LIVE Moderate: qemu-kvm security update 2015-10-27 08:50:32 EDT

  None (edit)
Description Martin Prpič 2015-03-06 11:20:32 EST 
It was found that the QEMU's websocket frame decoder processed incoming frames without limiting resources used to process the header and payload. An attacker able to access a guest's VNC console could use this flaw to trigger a denial of service on the host by exhausting all available memory and CPU.

Acknowledgements:

This issue was discovered by Daniel P. Berrange of Red Hat.
Comment 1 Martin Prpič 2015-03-06 11:22:03 EST 
Created attachment 998931 [details]
0001-CVE-2015-1779-incrementally-decode-websocket-frames.patch
Comment 2 Martin Prpič 2015-03-06 11:22:29 EST 
Created attachment 998932 [details]
0002-CVE-2015-1779-limit-size-of-HTTP-headers-from-websoc.patch
Comment 4 Martin Prpič 2015-03-10 05:24:12 EDT 
Created attachment 999785 [details]
0001-CVE-2015-1779-incrementally-decode-websocket-frames.patch
Comment 5 Martin Prpič 2015-03-10 05:24:41 EDT 
Created attachment 999786 [details]
0002-CVE-2015-1779-limit-size-of-HTTP-headers-from-websoc.patch
Comment 6 Petr Matousek 2015-03-19 12:04:39 EDT 
Statement:

This issue did not affect the kvm and qemu-kvm packages as shipped with Red Hat Enterprise Linux 5 and 6.
Comment 7 Daniel Berrange 2015-03-23 19:09:31 EDT 
Patches now posted publically upstream at:

https://lists.gnu.org/archive/html/qemu-devel/2015-03/msg04894.html
Comment 8 Petr Matousek 2015-03-24 03:18:16 EDT 
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1205051]
Comment 11 Petr Matousek 2015-04-09 10:28:14 EDT 
Upstream patches:

http://git.qemu.org/?p=qemu.git;a=commit;h=a2bebfd6e09d
http://git.qemu.org/?p=qemu.git;a=commit;h=2cdb5e142fb93

Please note that the first patch committed to QEMU project git is slightly different than the proposed patches (includes fix for a regression).
Comment 12 Fedora Update System 2015-04-21 14:50:47 EDT 
qemu-2.3.0-0.3.rc2.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 errata-xmlrpc 2015-10-26 17:23:06 EDT 
This issue has been addressed in the following products:

  RHEV-H and Agents for RHEL-7

Via RHSA-2015:1931 https://rhn.redhat.com/errata/RHSA-2015-1931.html
Comment 14 errata-xmlrpc 2015-10-27 04:50:44 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:1943 https://rhn.redhat.com/errata/RHSA-2015-1943.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.