Buffer overflow in SPICE - CVE-2018-10873
Published: August 24, 2018 / Updated: August 27, 2018
Vulnerability identifier: #VU14533
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-10873
CWE-ID: CWE-120
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.
The vulnerability exists due to buffer overflow in the write_validate_array_item()function when python_modules/demarshal.py code is used for demarshalling messages, as defined in the python_modules/demarshal.py code. A remote attacker can send specially crafted messages that submit malicious input to a targeted system. A successful exploit could trigger memory corruption and cause the service to crash.
Affected software
SPICE
Debian Linux
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
spice (Alpine package)
Debian Linux
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
spice (Alpine package)
How to mitigate CVE-2018-10873
Install update from vendor's website.
spice (Alpine package) - addressed in versions 0.12.8-r4, 0.13.3-r3