Bug 1256672 - (CVE-2015-5279) CVE-2015-5279 qemu: Heap overflow vulnerability in ne2000_receive() function
CVE-2015-5279 qemu: Heap overflow vulnerability in ne2000_receive() function
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20150915,repo...
: Security
Depends On: 1263272 1263273 1263274 1263275 1263276 1263277 1263278 1263279 1263280 1263287 1267466
Blocks: 1256675
  Show dependency treegraph
 
Reported: 2015-08-25 04:48 EDT by Adam Mariš
Modified: 2018-03-30 17:38 EDT (History)
44 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance (denial of service) or potentially execute arbitrary code on the host.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Crash report (201.55 KB, image/jpeg)
2015-08-25 04:49 EDT, Adam Mariš
no flags Details

  None (edit)
Description Adam Mariš 2015-08-25 04:48:30 EDT
Qemu emulator built with the NE2000 NIC emulation support is vulnerable to a heap buffer overflow issue. It could occur when receiving packets over the network.

A privileged user inside guest could use this flaw to crash the Qemu instance or potentially execute arbitrary code on the host.

Upstream fix:
-------------
  -> https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg03984.html

Reference:
----------
  -> http://www.openwall.com/lists/oss-security/2015/09/15/3
Comment 1 Adam Mariš 2015-08-25 04:49:33 EDT
Created attachment 1066783 [details]
Crash report
Comment 3 Prasad J Pandit 2015-09-15 08:03:06 EDT
Statement: 

This issue affects the versions of kvm and xen packages as shipped with Red Hat Enterprise Linux 5.

This issue affects the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6.

This issue affects the Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.

This issue does not affect the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 7.

This issue does not affect the Red Hat Enterprise Linux 7 based versions of the qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.
Comment 9 Prasad J Pandit 2015-09-15 09:25:32 EDT
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1263278]
Comment 10 Prasad J Pandit 2015-09-15 09:40:10 EDT
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1263287]
Comment 12 Fedora Update System 2015-09-24 01:08:41 EDT
qemu-2.4.0-4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 17 Fedora Update System 2015-10-03 13:34:12 EDT
xen-4.5.1-9.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 18 Fedora Update System 2015-10-04 18:50:12 EDT
xen-4.5.1-9.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 19 Fedora Update System 2015-10-04 19:19:26 EDT
xen-4.4.3-4.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
Comment 20 Fedora Update System 2015-10-09 06:28:52 EDT
qemu-2.3.1-5.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 21 Fedora Update System 2015-10-09 07:20:33 EDT
qemu-2.1.3-11.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
Comment 22 Summer Long 2015-10-14 19:51:51 EDT
Acknowledgements:

Red Hat would like to thank Qinghao Tang of QIHU 360 Inc. for reporting this issue.
Comment 23 errata-xmlrpc 2015-10-15 08:17:51 EDT
This issue has been addressed in the following products:

  OpenStack 5 for RHEL 6

Via RHSA-2015:1896 https://rhn.redhat.com/errata/RHSA-2015-1896.html
Comment 25 errata-xmlrpc 2015-10-22 12:44:14 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2015:1925 https://rhn.redhat.com/errata/RHSA-2015-1925.html
Comment 26 errata-xmlrpc 2015-10-22 12:44:41 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:1924 https://rhn.redhat.com/errata/RHSA-2015-1924.html
Comment 27 errata-xmlrpc 2015-10-22 12:45:21 EDT
This issue has been addressed in the following products:

  RHEV-H and Agents for RHEL-6

Via RHSA-2015:1923 https://rhn.redhat.com/errata/RHSA-2015-1923.html
Comment 28 errata-xmlrpc 2015-11-16 13:58:28 EST
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2015:2065 https://rhn.redhat.com/errata/RHSA-2015-2065.html

Note You need to log in before you can comment on or make changes to this bug.