Bug 717399 (CVE-2011-2512) - CVE-2011-2512 qemu-kvm: OOB memory access caused by negative vq notifies
Summary: CVE-2011-2512 qemu-kvm: OOB memory access caused by negative vq notifies
Alias: CVE-2011-2512
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 707094 717403
TreeView+ depends on / blocked
Reported: 2011-06-28 18:29 UTC by Petr Matousek
Modified: 2019-09-29 12:45 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2013-05-08 18:32:13 UTC

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:0919 normal SHIPPED_LIVE Important: qemu-kvm security and bug fix update 2011-07-05 18:07:54 UTC

Description Petr Matousek 2011-06-28 18:29:14 UTC
The virtio_queue_notify() function checks that the virtqueue number is less than the maximum number of virtqueues.  A signed comparison is used but the virtqueue number could be negative if a buggy or malicious guest is run.  This results in memory accesses outside of the virtqueue array. 

To trigger this issue the attacker needs to issue 32bit write to Queue Notify field of Virtio Header in the virtio pci config space even though the field is 16bit only by specs. Qemu-kvm allows that for the moment and provides whole 32bit value to the underlying functions.

Unprivileged guest user could use this flaw to crash the guest (denial of service) or, possibly, escalate their privileges on the host.

Upstream patch:

Comment 3 Petr Matousek 2011-06-28 18:44:01 UTC

This issue only affects Red Hat Enterprise Linux 6. The version of the qemu/kvm
as shipped with Red Hat Enterprise Linux 5 is not affected.

Comment 5 errata-xmlrpc 2011-07-05 18:08:04 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0919 https://rhn.redhat.com/errata/RHSA-2011-0919.html

Note You need to log in before you can comment on or make changes to this bug.