Bug 1243563 (CVE-2015-5154, xsa138) - CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access
Summary: CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-5154, xsa138
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1243689 1243690 1243691 1243692 1243696 1243698 1243699 1247141 1247142 1247143
Blocks: 1227412
TreeView+ depends on / blocked
 
Reported: 2015-07-15 19:20 UTC by Petr Matousek
Modified: 2023-05-12 10:23 UTC (History)
52 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A heap buffer overflow flaw was found in the way QEMU's IDE subsystem handled I/O buffer access while processing certain ATAPI commands. A privileged guest user in a guest with the CDROM drive enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.
Clone Of:
Environment:
Last Closed: 2015-07-28 22:49:44 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1507 0 normal SHIPPED_LIVE Important: qemu-kvm security and bug fix update 2015-07-27 17:31:59 UTC
Red Hat Product Errata RHSA-2015:1508 0 normal SHIPPED_LIVE Important: qemu-kvm-rhev security update 2015-07-27 16:59:36 UTC
Red Hat Product Errata RHSA-2015:1512 0 normal SHIPPED_LIVE Important: qemu-kvm-rhev security update 2015-07-28 21:50:13 UTC

Description Petr Matousek 2015-07-15 19:20:31 UTC 
A heap overflow flaw was found in the way QEMU's IDE subsystem
handled I/O buffer access while processing certain ATAPI commands.

A privileged guest user in a guest with CDROM drive enabled could
potentially use this flaw to execute arbitrary code on the host
with the privileges of the host's QEMU process corresponding to
the guest.

Upstream fix:
-------------
  -> git.qemu.org/?p=qemu.git;a=commit;h=d2ff85854512574e7209f295e87b0835d5b032c6

Acknowledgements:

This issue was discovered by Kevin Wolf of Red Hat.
Comment 2 Petr Matousek 2015-07-16 06:08:30 UTC 
Statement:

This issue does not affect the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5, the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6 and the Red Hat Enterprise Linux 6 based qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3, because they did not backport the upstream commit that introduced this issue.

This issue does affect the versions of qemu-kvm packages as shipped with Red Hat Enterprise Linux 7 and versions of Red Hat Enterprise Linux 7 based qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3. Future updates for the respective releases will address this flaw.
Comment 7 Petr Matousek 2015-07-20 11:56:26 UTC 
This issue was introduced via QEMU upstream commit http://git.qemu.org/?p=qemu.git;a=commit;h=ce560dcf .
Comment 8 Petr Matousek 2015-07-27 12:08:46 UTC 
Xen Project Advisory:

http://www.openwall.com/lists/oss-security/2015/07/27/3
Comment 9 Petr Matousek 2015-07-27 12:27:16 UTC 
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1247142]
Comment 10 Petr Matousek 2015-07-27 12:27:23 UTC 
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1247141]
Affects: epel-7 [bug 1247143]
Comment 11 Petr Matousek 2015-07-27 12:39:05 UTC 
Upstream QEMU patch(es) submission:

https://lists.gnu.org/archive/html/qemu-devel/2015-07/msg05162.html
Comment 12 errata-xmlrpc 2015-07-27 12:59:47 UTC 
This issue has been addressed in the following products:

  RHEV-H and Agents for RHEL-7

Via RHSA-2015:1508 https://rhn.redhat.com/errata/RHSA-2015-1508.html
Comment 13 errata-xmlrpc 2015-07-27 13:32:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:1507 https://rhn.redhat.com/errata/RHSA-2015-1507.html
Comment 14 errata-xmlrpc 2015-07-28 18:13:11 UTC 
This issue has been addressed in the following products:

  OpenStack 5 for RHEL 7
  OpenStack 6 for RHEL 7

Via RHSA-2015:1512 https://rhn.redhat.com/errata/RHSA-2015-1512.html
Comment 17 Fedora Update System 2015-08-10 10:03:09 UTC 
xen-4.5.1-5.fc23 has been pushed to the Fedora 23 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 18 Fedora Update System 2015-08-12 06:57:28 UTC 
xen-4.5.1-5.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 19 Fedora Update System 2015-08-12 07:01:06 UTC 
xen-4.4.2-9.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 20 Fedora Update System 2015-08-18 05:16:50 UTC 
qemu-2.3.1-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 21 Fedora Update System 2015-08-23 16:40:55 UTC 
qemu-2.4.0-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 22 Fedora Update System 2015-09-01 07:26:26 UTC 
qemu-2.1.3-9.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.