618812 – (CVE-2017-5526) <app-emulation/qemu-2.9.0: hw/audio/es1370c memory leak (CVE-2017-5526)

Bug 618812 (CVE-2017-5526) - <app-emulation/qemu-2.9.0: hw/audio/es1370c memory leak (CVE-2017-5526)

Summary: <app-emulation/qemu-2.9.0: hw/audio/es1370c memory leak (CVE-2017-5526)

Status:	RESOLVED DUPLICATE of bug 606264

Alias:	CVE-2017-5526

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	B3 [stable/cve]
Keywords:

Depends on:
Blocks:

Reported:	2017-05-18 05:00 UTC by GLSAMaker/CVETool Bot
Modified:	2017-05-18 10:37 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description GLSAMaker/CVETool Bot gentoo-dev

2017-05-18 05:00:15 UTC

CVE-2017-5526 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5526):
  Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local
  guest OS privileged users to cause a denial of service (host memory
  consumption and QEMU process crash) via a large number of device unplug
  operations.

Comment 1 Yury German Gentoo Infrastructure

2017-05-18 05:01:56 UTC

I do not see this in our bugs but I think it might be already covered by previous version.  Please advise.

Comment 2 Matthias Maier gentoo-dev

2017-05-18 05:11:38 UTC

This is fixed in upstream commit

  069eb7b2b8fc47c7cb52e5a4af23ea98d939e3da

which is present in 2.9.0.

Comment 3 Agostino Sarubbo gentoo-dev

2017-05-18 10:37:43 UTC

we fixed this bug in our 2.8.0-r1

*** This bug has been marked as a duplicate of bug 606264 ***