Bug 1810390 (CVE-2019-20382) - CVE-2019-20382 QEMU: vnc: memory leakage upon disconnect
Summary: CVE-2019-20382 QEMU: vnc: memory leakage upon disconnect
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-20382
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1788421 1810391 1810408 1810409 1810410 1810411 1816763 1869488
Blocks: 1810201
TreeView+ depends on / blocked
 
Reported: 2020-03-05 06:50 UTC by Prasad Pandit
Modified: 2021-02-16 20:30 UTC (History)
35 users (show)

Fixed In Version: qemu-4.2.0
Doc Type: If docs needed, set a value
Doc Text:
A memory leakage flaw was found in the way the VNC display driver of QEMU handled the connection disconnect when ZRLE and Tight encoding are enabled. Two VncState objects are created, and one allocates memory for the Zlib's data object. This allocated memory is not freed upon disconnection, resulting in a memory leak. An attacker able to connect to the VNC server could use this flaw to leak host memory, leading to a potential denial of service.
Clone Of:
Environment:
Last Closed: 2020-06-30 17:20:30 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:2774 0 None None None 2020-06-30 14:08:33 UTC
Red Hat Product Errata RHSA-2020:3267 0 None None None 2020-08-03 07:23:26 UTC
Red Hat Product Errata RHSA-2020:3906 0 None None None 2020-09-29 19:44:07 UTC
Red Hat Product Errata RHSA-2020:3907 0 None None None 2020-09-29 19:46:09 UTC
Red Hat Product Errata RHSA-2020:4167 0 None None None 2020-10-05 09:58:37 UTC

Description Prasad Pandit 2020-03-05 06:50:03 UTC 
A memory leakage flaw was found in the way VNC display driver of QEMU handled connection disconnect, when ZRLE, Tight encoding is enabled. It creates two vncState objects, one of which allocates memory for Zlib's data object. This allocated memory is not free'd upon disconnection resulting in the said memory leakage issue. A user able to connect to the VNC server could use this flaw to leak host memory leading to a potential DoS scenario.

Upstream patch:
---------------
  -> https://git.qemu.org/?p=qemu.git;a=commitdiff;h=6bf21f3d83e95bcc4ba35a7a07cc6655e8b010b0
Comment 1 Prasad Pandit 2020-03-05 06:50:40 UTC 
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1810391]
Comment 3 Mauro Matteo Cascella 2020-03-24 16:10:15 UTC 
Statement:

This flaw did not affect the versions of `qemu-kvm` as shipped with Red Hat Enterprise Linux 6 as they did not include the vulnerable code.
Comment 5 errata-xmlrpc 2020-06-30 14:08:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:2774 https://access.redhat.com/errata/RHSA-2020:2774
Comment 6 Product Security DevOps Team 2020-06-30 17:20:30 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-20382
Comment 7 errata-xmlrpc 2020-08-03 07:23:22 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
  Red Hat Virtualization Engine 4.3

Via RHSA-2020:3267 https://access.redhat.com/errata/RHSA-2020:3267
Comment 8 Prasad Pandit 2020-08-18 06:09:02 UTC 
External References:

https://www.openwall.com/lists/oss-security/2020/03/05/1
Comment 10 errata-xmlrpc 2020-09-29 19:44:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3906 https://access.redhat.com/errata/RHSA-2020:3906
Comment 11 errata-xmlrpc 2020-09-29 19:45:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:3907 https://access.redhat.com/errata/RHSA-2020:3907
Comment 17 errata-xmlrpc 2020-10-05 09:58:39 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 13.0 (Queens)
  Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS

Via RHSA-2020:4167 https://access.redhat.com/errata/RHSA-2020:4167
Note You need to log in before you can comment on or make changes to this bug.