A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. It occurs in ip_reass() routine while reassembling incoming packets, if the first fragment is bigger than the m->m_dat[] buffer. A user/process could use this flaw to crash the Qemu process on the host resulting in DoS. Upstream patch: --------------- -> https://gitlab.freedesktop.org/slirp/libslirp/commit/c59279437eda91841b9d26079c70b8a540d41204
Created qemu tracking bugs for this issue: Affects: fedora-all [bug 1749730]
Statement: Red Hat OpenStack Platform: * This flaw impacts KVM user-mode or SLIRP networking, which is not used in Red Hat OpenStack Platform. Although updating is recommended for affected versions (see below), Red Hat OpenStack Platform environments are not vulnerable.
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2020:0775 https://access.redhat.com/errata/RHSA-2020:0775
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-15890
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extras Via RHSA-2020:0889 https://access.redhat.com/errata/RHSA-2020:0889
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4676 https://access.redhat.com/errata/RHSA-2020:4676