Heap-based buffer overflow in xen (Alpine package)

1) Heap-based buffer overflow

EUVDB-ID: #VU6934

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-9603

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

Quick Emulator(Qemu) built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support is vulnerable to a heap buffer overflow issue. It could occur when Vnc client attempts to update its display after a vga operation is performed by a guest. A privileged user/process inside guest could use this flaw to crash the Qemu process resulting in DoS OR potentially leverage it to execute arbitrary code on the host with privileges of the Qemu process.

Mitigation

Install update from vendor's website.

Vulnerable software versions

xen (Alpine package): 4.5.5-r0

External links

http://git.alpinelinux.org/aports/commit/?id=2aae6d20dcc445e55f3afde8a9c1c91f9bb4b7f5
http://git.alpinelinux.org/aports/commit/?id=aa5f8776542923a6004a10095d7c75435c70d3df
http://git.alpinelinux.org/aports/commit/?id=5a58568f86fb352acf6c7598f8c7fdf05749676a
http://git.alpinelinux.org/aports/commit/?id=abd894aa9e7936d2fab2956aef4da42c08d8874a
http://git.alpinelinux.org/aports/commit/?id=da85ca277a6878be7b6a40d6904d52c522ed214d

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.