Buffer overflow in QEMU - CVE-2019-6501

Vulnerability identifier: #VU18274

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-6501

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform denial of service attack.

The vulnerability exists due to a boundary error within the scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c. A local user can create a specially crafted application, trigger buffer overflow and crash the affected emulator.

QEMU
Red Hat Virtualization Manager
Red Hat Virtualization
Red Hat Virtualization for IBM Power LE
Red Hat Enterprise Linux for IBM z Systems
Red Hat OpenStack
Red Hat OpenStack for IBM Power
qemu-kvm-rhev (Red Hat package)

Install update from vendor's website.

qemu-kvm-rhev (Red Hat package) - update to 2.12.0-33.el7

• http://www.openwall.com/lists/oss-security/2019/01/24/1
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJMTVGDLA654HNCDGLCUEIP36SNJEKK7/
• https://lists.gnu.org/archive/html/qemu-devel/2019-01/msg02324.html

• Red Hat update for qemu-kvm-ma
• Red Hat update for qemu-kvm-rhev
• Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 and Red Hat Virtualization Engine 4.3 update for qemu-kvm-rhev