Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 620780 (CVE-2017-9373) - <app-emulation/qemu-2.9.0: ide: ahci host memory leakage during hotunplug
Summary: <app-emulation/qemu-2.9.0: ide: ahci host memory leakage during hotunplug
Status: RESOLVED FIXED
Alias: CVE-2017-9373
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B4 [cve noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-06-04 13:45 UTC by Agostino Sarubbo
Modified: 2017-08-05 22:49 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2017-06-04 13:45:08 UTC 
From ${URL} :

Quick emulator built with the IDE AHCI Emulation support is vulnerable to a
host memory leakage issue. It could occur while hot-unplugging the AHCI device.

A privileged user inside guest could use this flaw to leak host memory
resulting in DoS.

Upstream patch:
---------------
  -> http://git.qemu.org/?p=qemu.git;a=commitdiff;h=d68f0f778e7f4fbd674627274267f269e40f0b04


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Volkan 2017-06-15 19:08:00 UTC 
CVE is CVE-2017-9373
Comment 2 Matthias Maier gentoo-dev 2017-07-26 17:05:12 UTC 
This commit is already in upstream version 2.9.0.
Comment 3 Aaron Bauman (RETIRED) gentoo-dev 2017-08-05 22:49:53 UTC 
GLSA Vote: No

Tree is clean.