| Summary: | app-emulation/qemu: usb: Infinite loop vulnerability in usb_ehci using siTD process | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | minor | CC: | qemu+disabled |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg02691.html | ||
| See Also: | https://bugzilla.redhat.com/show_bug.cgi?id=1325129 | ||
| Whiteboard: | B3 [upstream] | ||
| Package list: | Runtime testing required: | --- | |
the referenced fix requires the fix for bug 568246 to be reverted. since we didn't do that, the security issue isn't exposed. they landed the change to fix behavior on FreeBSD, so i'll add what went into master (the revert+update). *** This bug has been marked as a duplicate of bug 568246 *** |
From ${URL} : Qemu emulator built with the USB EHCI emulation support is vulnerable to an infinite loop issue. It occurs during communication between host controller interface(EHCI) and a respective device driver. These two communicate via a split isochronous transfer descriptor list(siTD) and an infinite loop unfolds if there is a closed loop in this list. A privileges used inside guest could use this flaw to consume excessive CPU cycles & resources on the host. This issue is similar to CVE-2015-8558, but using siTD instead of iTD. Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg02691.html Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/04/18/3 @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.