Описание
m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
A heap buffer overflow issue was found in the way SLiRP networking back-end in QEMU processes fragmented packets. It could occur while reassembling the fragmented datagrams of an incoming packet. A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS or potentially leverage it to execute arbitrary code on the host with privileges of the QEMU process.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | kvm | Will not fix | ||
| Red Hat Enterprise Linux 5 | xen | Not affected | ||
| Red Hat Enterprise Linux 8 | qemu-kvm | Not affected | ||
| Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) | qemu-kvm-rhev | Will not fix | ||
| Red Hat Enterprise Linux 6 | qemu-kvm | Fixed | RHSA-2019:2892 | 24.09.2019 |
| Red Hat Enterprise Linux 7 | qemu-kvm | Fixed | RHSA-2018:2462 | 16.08.2018 |
| Red Hat Enterprise Linux 7 | qemu-kvm-ma | Fixed | RHSA-2018:2762 | 25.09.2018 |
| Red Hat OpenStack Platform 10.0 (Newton) | qemu-kvm-rhev | Fixed | RHSA-2018:2822 | 27.09.2018 |
| Red Hat OpenStack Platform 12.0 (Pike) | qemu-kvm-rhev | Fixed | RHSA-2018:2822 | 27.09.2018 |
| Red Hat OpenStack Platform 13.0 (Queens) | qemu-kvm-rhev | Fixed | RHSA-2018:2822 | 27.09.2018 |
Показывать по
Дополнительная информация
Статус:
5.1 Medium
CVSS3
Связанные уязвимости
m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via inc ...
m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
Уязвимость функции m_cat эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю оказать воздействие на целостность данных, получить несанкционированный доступ к защищаемой информации, а также вызвать отказ в обслуживании
5.1 Medium
CVSS3