oss-sec mailing list archives
Re: CVE Request Qemu: scsi: esp: OOB write when using non-DMA mode in get_cmd
From: cve-assign () mitre org
Date: Thu, 2 Jun 2016 12:11:23 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Quick Emulator(Qemu) built with the ESP/NCR53C9x controller emulation support is vulnerable to an OOB write access issue. The controller uses 16-byte FIFO buffer for command and information transfer. The OOB write occurs while reading from information transfer buffer via non-DMA mode in routine get_cmd(). A privileged user inside guest could use this flaw to crash the Qemu process resulting in DoS. https://bugzilla.redhat.com/show_bug.cgi?id=1341931 https://lists.gnu.org/archive/html/qemu-devel/2016-06/msg00150.html
Add check to validate command length against buffer size to avoid any overrun.
Use CVE-2016-5238. The scope of this CVE is the missing "dmalen > TI_BUFSZ" check in the get_cmd function. The scope of this CVE does not include the "At least the following patch is needed to ensure that ti_size always matches ti_rptr/ti_wptr" discussion. This is not yet available at http://git.qemu.org/?p=qemu.git;a=history;f=hw/scsi/esp.c but that may be an expected place for a later update.
In theory this shouldn't happen, but I agree that it is better to be defensive.
We typically can still assign a CVE ID with that response. We cannot assign a CVE ID with a response of "there is no vulnerability but I'm accepting the defense-in-depth code change." Admittedly this is sometimes a difficult distinction. - -- CVE Assignment Team M/S M300, 202 Burlington Road, Bedford, MA 01730 USA [ A PGP key is available for encrypted communications at http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJXUFo9AAoJEHb/MwWLVhi2HgcP+wWpJhmbyE55xndbleU5kBUX MyF83fzuj/PhM5ShgCI3y+VPQ7GmabZ4ui03qIhQl8NGdO4JW8PD1rRYJJ0gouVW UCi6JXQLQt8nlOQ0g4ROKTyONiKt5kc+9y6NoDZO16v7gd8gPFkoF6Z7JGOoizTA 7Si/nCVB5XPWyRG8eEYNyxEXKxq6bdKvWlSYkwIHNDR9bWjCCy915vg/VyIjG9td thbASw7Ocem811eH79h7E5prm1MBb4Dmjlgbw/1TPeAvbVRki+KFqbdG1UVe0nJk 6DD+TfyNrk4DERuzN97XTaltz7s+lyNWhObLuDHrhmQV8DNYiPz63wP45QVD3vff kjw8xnmuGhAyWhBenWBaUJ2HPFTJoXob5+Knvdo6JWH5Y8ES8Ob9gBbaKRnKhs6u dM/Kdht9A1DCHG0+QKCYlT8GfERutCPgjejyGxhBauRTnPztxTTr6/3G0BOkU3j9 s1gUkWjk2SONM2mtnFa0Kd3ZU+qE+9k9EoBf4DZnRY+BnBfd/Nq2j78vTQiIrBOn oT42usKfbCKFiixbJKH2pVsreherp+eau4UirjoksIbftCIeCiWA90wfi0Dhoi3P ydwB2X0Eh9Jy1IN9Pu/sc5IrA7sMMHTRByomyxYcZmu1oOAoOTH7qmNBYSxrKA1Z DB5KI7w/WY+cLrwaUhxv =kY8R -----END PGP SIGNATURE-----
Current thread:
- CVE Request Qemu: scsi: esp: OOB write when using non-DMA mode in get_cmd P J P (Jun 01)
- Re: CVE Request Qemu: scsi: esp: OOB write when using non-DMA mode in get_cmd cve-assign (Jun 02)