An infinite loop issue was found in the USB OHCI controller emulator of QEMU. It could occur while servicing OHCI isochronous transfer descriptors (TD) in ohci_service_iso_td routine, as it retires a TD if it has passed its time frame. While do so it does not check if the TD was already processed ones and holds an error code in TD_CC. It may happen if the TD list has a loop. A guest user/process may use this flaw to consume cpu cycles on the host resulting in DoS scenario. Upstream patch: --------------- -> https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg05905.html Reference: ---------- -> https://www.openwall.com/lists/oss-security/2020/09/17/1
Created qemu tracking bugs for this issue: Affects: fedora-all [bug 1879809] Created xen tracking bugs for this issue: Affects: fedora-all [bug 1879810]