Bug 1812659 (CVE-2019-15034) - CVE-2019-15034 qemu: hw/display/bochs-display.c does not ensure a sufficient PCI config space allocation leading to a buffer overflow involving the PCIe extended config space
Summary: CVE-2019-15034 qemu: hw/display/bochs-display.c does not ensure a sufficient ...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-15034
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1810201
TreeView+ depends on / blocked
 
Reported: 2020-03-11 19:06 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-02-16 20:28 UTC (History)
35 users (show)

Fixed In Version: qemu 4.1.0
Clone Of:
Environment:
Last Closed: 2020-04-02 22:31:50 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-03-11 19:06:49 UTC 
hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe extended config space.

Reference:
https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01959.html
Comment 2 Mauro Matteo Cascella 2020-03-25 16:08:37 UTC 
Mitigation:

Use `-device bochs-display` as conventional PCI device only.
Comment 3 Nick Tait 2020-04-02 16:33:15 UTC 
Statement:

This flaw does not affect the module stream`virt:8.1/qemu-kvm` as shipped with RHEL Advanced Virtualization, as it already includes the patch.
Several other packages are unaffected because they do not include PCIe support:
* `kvm` and `xen` as shipped with Red Hat Enterprise Linux 5
* `qemu-kvm` as shipped with Red Hat Enterprise Linux 6 and 7
* `qemu-kvm-rhev` as shipped with Red Hat Enterprise Linux 7
* `virt:rhel/qemu-kvm` as shipped with Red Hat Enterprise Linux 8
* `qemu-kvm-rhev` as shipped with Red Hat OpenStack Platform 10 and 13
Comment 4 Product Security DevOps Team 2020-04-02 22:31:50 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-15034
Note You need to log in before you can comment on or make changes to this bug.