Off-by-one in SPICE - CVE-2019-3813

Vulnerability identifier: #VU17324

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-3813

CWE-ID: CWE-193

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an adjacent authenticated attacker to cause DoS condition.

The vulnerability exists due to an off-by-one error in memslot_get_virt. An adjacent can trigger out-of-bounds read and cause the program to crash if it received specially crafted network traffic. In case the attacker in unauthenticated it's possible to execute arbitrary code.

SPICE
Arch Linux
Gentoo Linux
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Opensuse
Fedora
spice (Debian package)
spice (Alpine package)
spice
Red Hat Virtualization
Red Hat Virtualization Host

Update to version 0.14.2.

SPICE - update to 0.14.2
spice (Debian package) - update to 0.12.8-2.1+deb9u3
spice (Alpine package) - update to 0.13.3-r4
spice - addressed in versions 0.14.0-5.fc28, 0.14.1-2.fc29

• https://bugzilla.redhat.com/show_bug.cgi?id=1665371

• Arch Linux update for spice
• Arch Linux update for spice
• OpenSUSE Linux update for spice
• OpenSUSE Linux update for spice
• Debian update for spice
• Red Hat update for redhat-virtualization-host
• Red Hat update for spice-server
• Red Hat update for spice
• Gentoo update for spice
• Off-by-one in spice (Alpine package)
• Fedora 28 update for spice
• Fedora 29 update for spice