Bug 1773749 (CVE-2019-12068) - CVE-2019-12068 qemu: scsi: lsi: potential infinite loop when executing script in lsi_execute_script
Summary: CVE-2019-12068 qemu: scsi: lsi: potential infinite loop when executing script...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-12068
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1773750 1773751 1780346 1780347 1780348 1780349 1781422 1782735
Blocks: 1710974 1773752
TreeView+ depends on / blocked
 
Reported: 2019-11-18 20:46 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-02-16 21:02 UTC (History)
39 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2019-12-06 14:34:40 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2019-11-18 20:46:26 UTC 
Qemu emulator built with the LSI53C895A SCSI Host Bus Adapter emulation support
is vulnerable to an infinite loop issue. It could occur when executing a script
in lsi_execute_script(). The LSI scsi adapter emulator advances 's->dsp' index
to read next opcode. This can lead to an infinite loop if the next opcode is
empty.

A privileged user inside guest could use this flaw to consume CPU cycles on
the host resulting in DoS scenario.

Upstream patch:
---------------
  -> https://git.qemu.org/?p=qemu.git;a=commit;h=de594e47659029316bbf9391efb79da0a1a08e08
Comment 1 Guilherme de Almeida Suckevicz 2019-11-18 20:46:50 UTC 
Created qemu tracking bugs for this issue:

Affects: epel-7 [bug 1773751]
Affects: fedora-all [bug 1773750]
Comment 3 Paolo Bonzini 2019-12-06 14:34:40 UTC 
The device is not included in RHEL.
Comment 7 Eric Christensen 2019-12-09 21:03:32 UTC 
Statement:

The qemu-kvm package versions as shipped with Red Hat Enterprise Linux 6, 7, and 8 are not affected by this issue, as the device, LSI53C895A, is not included in these versions.
Comment 9 Prasad Pandit 2019-12-12 08:52:49 UTC 
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1782735]
Note You need to log in before you can comment on or make changes to this bug.