Bug 1759820 (CVE-2019-12067) - CVE-2019-12067 QEMU: NULL dereference in ahci_commit_buf() leading to DoS
Summary: CVE-2019-12067 QEMU: NULL dereference in ahci_commit_buf() leading to DoS
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-12067
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1759910 1759911 1779881 1779882 1782763 1782765 1782789 1793218
Blocks: 1710974 1759821
TreeView+ depends on / blocked
 
Reported: 2019-10-09 08:20 UTC by Marian Rehak
Modified: 2021-10-25 09:52 UTC (History)
35 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A NULL pointer dereference flaw was found in the QEMU emulator's IDE AHCI emulator. Exploitation of the flaw could occur while committing DMA buffer in ahci_commit_buf() if the command header 'ad->cur_cmd' was null. A privileged guest user could use this flaw to crash the QEMU process instance resulting in DoS. Reduced performance of the system is the highest threat to the system.
Clone Of:
Environment:
Last Closed: 2021-10-25 09:52:47 UTC
Embargoed:

Attachments (Terms of Use)

Description Marian Rehak 2019-10-09 08:20:27 UTC 
QEMU emulator built with the AHCI emulator support is vulnerable to a NULL pointer dereference issue. It could occur while committing DMA buffer in ahci_commit_buf() if the command header 'ad->cur_cmd' is null.

A privileged guest user could use this flaw to crash the QEMU process instance resulting in DoS.

Upstream Patch:
  -> https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01358.html
Comment 1 Marian Rehak 2019-10-09 11:58:08 UTC 
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1759911]


Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1759910]
Comment 8 Eric Christensen 2019-12-16 16:24:32 UTC 
Statement:

The qemu-kvm package versions as shipped with Red Hat Enterprise Linux 6 and 7 are not affected by this issue. 

The qemu-kvm package version as shipped with Red Hat Enterprise Linux 8 is affected by this issue. Future qemu-kvm updates for Red Hat Enterprise Linux 8 may address this issue.
Note You need to log in before you can comment on or make changes to this bug.