oss-sec mailing list archives
Re: CVE request Qemu: usb: ehci null pointer dereference in ehci_caps_write
From: cve-assign () mitre org
Date: Fri, 29 Jan 2016 20:15:01 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Qemu emulator built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the Qemu process instance resulting in DoS. https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05899.html https://bugzilla.redhat.com/show_bug.cgi?id=1301643
usb: ehci: add capability mmio write function
its mmio '.write' function was missing, which lead to a null pointer dereference issue
Use CVE-2016-2198. This is not yet available at http://git.qemu.org/?p=qemu.git;a=history;f=hw/usb/hcd-ehci.c but that may be an expected place for a later update. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJWrA0IAAoJEL54rhJi8gl58PcP/2F+tp54ZD2CLMjKWW4D9W5G YoICQDA5qfy7VkJDEOwOnZ4clI+F2KFaUh34p0BQ2IVNHsvc+wMMofOfO9enlkIY s7hKhWNvBeaSR4UPSej14hxtY32uqoD2jEHBo+XCQ8DLH1CFJcMvC6sqEhuOGS0I 1Ayl0xKBQTnl+5lFR2ayNMRbDac7lCvgVQx1jmptuydpuJW6h8CKzVt6hUyvZcL0 qPwA7Q/bqkz4KFFzFb1JvW81fHZ95pBxbfgNn+RNey+BAEm46hLtBZOjOf70qgto iRGWEuAEyAcHdAE9HwvKHFXNaNVACNftvoEnzeR5krvxQke2JujtQWU8gZRQ/DYP vzdhAWEmmXl1d708zywYasVHRQka62H1ou7RhcIvEKw542gUTvoTUL0wefnHKb6X 2fTzt3oQeE3OKqNYCXvcc6LxYqwCz9efcf4DX+e7VW2CbbDSvWghRgPwhZIj9+rr FEMQGtnN/NY7FnFBOlkUTRspk6sIsn3MeILU2hsNBuxzGs0vczM1fbYsdSEBR+2N KUlz5fMtC3bdl0/2xnb/ptdLxGEclbjWv8xnyT/McEFevIm2EqPi/iRz3YWgsJf0 O31vnHuf4WZMqT+thvERuzm6gNrR1IvL6KxQvWDnTRxes2HQk2Vs2wmKv5ccIFBV Ew8JiuDju097TPIRuhuT =EwFk -----END PGP SIGNATURE-----
Current thread:
- CVE request Qemu: usb: ehci null pointer dereference in ehci_caps_write P J P (Jan 29)
- Re: CVE request Qemu: usb: ehci null pointer dereference in ehci_caps_write cve-assign (Jan 29)