| Summary: |
<app-emulation/qemu-2.8.0-r1: serial: host memory leakage in 16550A UART (CVE-2017-5579) |
| Product: |
Gentoo Security
|
Reporter: |
Francis Booth <boothf> |
| Component: |
Vulnerabilities | Assignee: |
Gentoo Security <security> |
| Status: |
RESOLVED
FIXED
|
|
|
| Severity: |
minor
|
CC: |
qemu+disabled
|
| Priority: |
Normal
|
|
|
| Version: |
unspecified | |
|
| Hardware: |
All | |
|
| OS: |
Linux | |
|
| URL: |
http://www.openwall.com/lists/oss-security/2017/01/24/8
|
| Whiteboard: |
B4 [glsa cve] |
|
Package list:
|
|
Runtime testing required:
|
---
|
|---|
| Bug Depends on: |
608728
|
|
|
| Bug Blocks: |
|
|
|
From ${URL} : Quick Emulator(Qemu) built with the 16550A UART serial device emulation support is vulnerable to a memory leakage issue. It could occur while doing a device unplug operation; Doing so repeatedly would result in leaking host memory, affecting other services on the host. A privileged user inside guest could use this flaw to cause a DoS and/or potentially crash the Qemu process on the host. Upstream patch: --------------- -> https://lists.nongnu.org/archive/html/qemu-devel/2017-01/msg01945.html Reference: ---------- -> https://bugzilla.redhat.com/show_bug.cgi?id=1416157 Reproducible: Always