Bug 618812 (CVE-2017-5526)

Summary:	<app-emulation/qemu-2.9.0: hw/audio/es1370c memory leak (CVE-2017-5526)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	minor	CC:	qemu+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [stable/cve]
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2017-05-18 05:00:15 UTC

CVE-2017-5526 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5526):
  Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local
  guest OS privileged users to cause a denial of service (host memory
  consumption and QEMU process crash) via a large number of device unplug
  operations.

Comment 1 Yury German Gentoo Infrastructure

2017-05-18 05:01:56 UTC

I do not see this in our bugs but I think it might be already covered by previous version.  Please advise.

Comment 2 Matthias Maier gentoo-dev

2017-05-18 05:11:38 UTC

This is fixed in upstream commit

  069eb7b2b8fc47c7cb52e5a4af23ea98d939e3da

which is present in 2.9.0.

Comment 3 Agostino Sarubbo gentoo-dev

2017-05-18 10:37:43 UTC

we fixed this bug in our 2.8.0-r1

*** This bug has been marked as a duplicate of bug 606264 ***