Описание
hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| qemu | fixed | 1:4.1-1 | package | |
| qemu | not-affected | stretch | package | |
| qemu | not-affected | jessie | package | |
| qemu-kvm | removed | package |
Примечания
https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg02822.html
https://git.qemu.org/?p=qemu.git;a=commit;h=0e68373cc2b3a063ce067bc0cc3edaf370752890
PVRDMA support not enabled in the binary packages until 1:3.1+dfsg-3, disabled again in 1:3.1+dfsg-4
The issue is in PVRDMA support, cf. https://bugs.debian.org/922461#18
EPSS
Связанные уязвимости
hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value.
hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value.
hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value.
hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value.
Уязвимость компонента hw/rdma/rdma_backend.c виртуального сетевого адаптера PVRDMA эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
EPSS