Bug 1260076 (CVE-2015-6815) - CVE-2015-6815 qemu: net: e1000: infinite loop issue
Summary: CVE-2015-6815 qemu: net: e1000: infinite loop issue
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2015-6815
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1260224 1260225
Blocks: 1254448
TreeView+ depends on / blocked
 
Reported: 2015-09-04 11:33 UTC by Prasad Pandit
Modified: 2023-05-12 18:28 UTC (History)
20 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A flaw was found in the way a QEMU-emulated e1000 network interface card processed transmit descriptor data when sending a network packet. A privileged guest user could use this flaw to crash the guest.
Clone Of:
Environment:
Last Closed: 2015-09-14 05:27:45 UTC
Embargoed:

Attachments (Terms of Use)

Description Prasad Pandit 2015-09-04 11:33:39 UTC 
Qemu emulator built with the e1000 NIC emulation support is vulnerable to an
infinite loop issue. It could occur while processing transmit descriptor data
when sending a network packet.

A privileged user inside guest could use this flaw to crash the Qemu instance
resulting in DoS.

Upstream fix:
-------------
  -> https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg01199.html
Comment 1 Prasad Pandit 2015-09-04 19:51:25 UTC 
Statement: 

This issue affects the versions of kvm and xen packages as shipped with Red Hat Enterprise Linux 5.

This issue affects the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6 and 7.

This issue affects the Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.

This issue affect the Red Hat Enterprise Linux 7 based versions of the qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.
Comment 2 Prasad Pandit 2015-09-04 19:54:28 UTC 
This has been rated as having Low security impact and is not currently
planned to be addressed in future updates. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/.
Comment 3 Prasad Pandit 2015-09-04 19:57:59 UTC 
Acknowledgements:

This issue was discovered by Qinghao Tang of QIHU 360 Inc.
Comment 4 Prasad Pandit 2015-09-04 20:05:58 UTC 
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1260224]
Comment 5 Prasad Pandit 2015-09-04 20:06:00 UTC 
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1260225]
Comment 6 Huzaifa S. Sidhpurwala 2015-09-07 04:45:42 UTC 
This issue has been assigned CVE-2015-6815 via:


http://openwall.com/lists/oss-security/2015/09/05/5
Comment 8 Fedora Update System 2015-09-24 05:08:54 UTC 
qemu-2.4.0-4.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2015-10-03 17:34:06 UTC 
xen-4.5.1-9.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2015-10-04 22:50:05 UTC 
xen-4.5.1-9.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 11 Fedora Update System 2015-10-04 23:19:20 UTC 
xen-4.4.3-4.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
Comment 12 Fedora Update System 2015-10-09 10:29:04 UTC 
qemu-2.3.1-5.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 13 Fedora Update System 2015-10-09 11:20:46 UTC 
qemu-2.1.3-11.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.