[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <b52ce65719d94835a1628207ab996ffa@imshyb02.MITRE.ORG>
Date: Tue, 7 Feb 2017 20:14:20 -0500
From: <cve-assign@...re.org>
To: <ppandit@...hat.com>
CC: <cve-assign@...re.org>, <oss-security@...ts.openwall.com>,
<liqiang6-s@....cn>
Subject: Re: CVE request Qemu: virtio: integer overflow in handling virtio-crypto requests
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> Quick Emulator(Qemu) built with the Virtio Crypto device emulation support is
> vulnerable to an integer overflow issue. It could occur while handling data
> encryption/decryption requests in 'virtio_crypto_handle_sym_req'.
>
> A privileged user inside guest could use this flaw to crash the Qemu process
> resulting in DoS or potentially execute arbitrary code on the host with
> privileges of the Qemu process.
>
> https://lists.nongnu.org/archive/html/qemu-devel/2017-01/msg01368.html
> https://bugzilla.redhat.com/show_bug.cgi?id=1420092
> http://git.qemu-project.org/?p=qemu.git;a=commit;h=a08aaff811fb194950f79711d2afe5a892ae03a4
Use CVE-2017-5931.
- --
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJYmm+0AAoJEHb/MwWLVhi2B4sP+wfNcAISLT1m/fgfqNIvDW7u
FTDw5NMDO0QRah+v5DxJdGtJrUiBZdyRGNH84JxUhBkdv4BreRZIsoGJyKvkc6D4
5jUBxdSfpvd901pJ39A9YdA13lvCGOvkekCzAmwqW97l7gY0WL0E2t8kkRk/6Gu1
HPHAVtsU8oFC/Pn7tsVrqorzJjY+D/7pDpL67VoTuiXwwafoSWwPq1YWBgEmNh2z
ojPI8m43NPmWBeo3vCNOGsLLmgLqDCdg0Hct44PQcMDBWD0RXtWSrVQhiPuIeSgp
TO3T4NMh+pr7ZIs8THe7t3cOise7RiSmGd31MmzIhEttqxgEawU9UuTieXWStH4Y
SpUv2G22PP2vMFc+iNFthPaQIz1QMSenNyT2IlKEM0ObSKSNYio/TyHRO1U/ddOb
9mF/D/+uooJxc7+bwghbwUn56RAAUhp0FVBLxklLbwTXpA5wrK7ttugOc/4uOru2
IWH79Z0vWIKuGjGbwa0J1mRvugM0Nv04GGoxtIgKMmSvK2UIvdYa8Icd4teBiniL
DNi9AsooOQDhrY5d1KHAPGIXFQlZnsaafGXiEi2vACewcVUEy8syqGIFZ6ImU/ZF
6iG5UfBo91tRng1KgtRwkUu7x5E27/+vYxYo+1ezh1XTBYUZpV8/cqjB7xCQuy6p
BHYeFVTsdOsmy6zt3L+2
=ukgp
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
