Heap-based buffer overflow in QEMU - CVE-2019-6778

Vulnerability identifier: #VU18302

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-6778

CWE-ID: CWE-122

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the tcp_emu() function in slirp/tcp_subr.c. A local user can send specially crafted networking packets, trigger heap-based buffer overflow and crash the affected system.

QEMU
Red Hat Virtualization Manager
Red Hat Virtualization
Red Hat Virtualization for IBM Power LE
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Opensuse
Red Hat OpenStack
Red Hat OpenStack for IBM Power

Install updates from vendor's website.

QEMU - update to 3.1.0

• http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00073.html
• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00042.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html
• http://www.openwall.com/lists/oss-security/2019/01/24/5
• http://www.securityfocus.com/bid/106758
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CGCFIFSIWUREEQQOZDZFBYKWZHXCWBZN/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJMTVGDLA654HNCDGLCUEIP36SNJEKK7/
• https://lists.gnu.org/archive/html/qemu-devel/2019-01/msg03132.html
• https://usn.ubuntu.com/3923-1/

• OpenSUSE Linux update for xen
• OpenSUSE Linux update for qemu
• OpenSUSE Linux update for qemu
• Red Hat update for qemu-kvm-rhev
• Red Hat update for qemu-kvm
• Red Hat update for qemu-kvm-rhev
• OpenSUSE Linux update for podman, slirp4netns and libcontainers-common
• Red Hat update for qemu-kvm
• OpenSUSE Linux update for qemu