Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 621190 (CVE-2017-9374) - <app-emulation/qemu-2.9.0: usb: ehci host memory leakage during hotunplug
Summary: <app-emulation/qemu-2.9.0: usb: ehci host memory leakage during hotunplug
Status: RESOLVED FIXED
Alias: CVE-2017-9374
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-06-08 07:53 UTC by Agostino Sarubbo
Modified: 2017-08-08 00:04 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2017-06-08 07:53:41 UTC
From ${URL} :

Quick Emulator(Qemu) built with the USB EHCI Emulation support is vulnerable 
to a memory leakage issue. It could occur while hot-unplugging the device, as 
it does not release the memory allocated at initialisation.

A guest user/process could use this issue to leak host memory, resulting in 
DoS for host.

Upstream patch:
---------------
   -> http://git.qemu.org/?p=qemu.git;a=commit;h=d710e1e7bd3d5bfc26b631f02ae87901ebe646b0

Reference:
----------
   -> https://bugzilla.redhat.com/show_bug.cgi?id=1459132


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Matthias Maier gentoo-dev 2017-07-26 17:03:44 UTC
This commit is already in upstream version 2.9.0.
Comment 2 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2017-08-08 00:04:42 UTC
GLSA Vote: No