Bug 617514

Summary:	<app-emulation/qemu-2.9.0-r1 CVE-2017-8379 input: host memory leakage via keyboard events
Product:	Gentoo Security	Reporter:	Volkan <vBugZilla>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	normal	CC:	qemu+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://bugzilla.redhat.com/show_bug.cgi?id=1446547
Whiteboard:
Package list:		Runtime testing required:	---

Description Volkan 2017-05-04 18:43:55 UTC

Quick Emulator(Qemu) built with the keyboard input event handlers support is
vulnerable to a host memory leakage issue. It could occur if a guest user was
to generate large keyboard events, faster than Qemu could process them.

A privileged user inside guest could use this flaw to exhaust host memory,
resulting in DoS.

Upstream patch:
---------------
  -> https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg05599.html

Reference:
----------
  -> http://www.openwall.com/lists/oss-security/2017/05/03/2

Comment 1 Matthias Maier gentoo-dev

2017-05-04 19:10:53 UTC


*** This bug has been marked as a duplicate of bug 616872 ***