CVE-2015-3215: Input Validation
First published: Mon Dec 15 2014(Updated: )
It was found that the Windows Virtio NIC driver did not sufficiently sanitize the length of the incoming IP packets, as demonstrated by a packet with IP options present but the overall packet length not being adjusted to reflect the length of those options. A remote attacker able to send a specially crafted IP packet to the guest could use this flaw to crash that guest. Upstream commits: <a href="https://github.com/YanVugenfirer/kvm-guest-drivers-windows/commit/723416fa4210b7464b28eab89cc76252e6193ac1">https://github.com/YanVugenfirer/kvm-guest-drivers-windows/commit/723416fa4210b7464b28eab89cc76252e6193ac1</a> <a href="https://github.com/YanVugenfirer/kvm-guest-drivers-windows/commit/fbfa4d1083ea84c5429992ca3e996d7d4fbc8238">https://github.com/YanVugenfirer/kvm-guest-drivers-windows/commit/fbfa4d1083ea84c5429992ca3e996d7d4fbc8238</a> Acknowledgements: Red Hat would like to thank Google Project Zero for reporting this issue.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/virtio-win | <0:1.7.4-1.el6_6 | 0:1.7.4-1.el6_6 |
| redhat/virtio-win | <0:1.7.4-1.el7 | 0:1.7.4-1.el7 |
| virtio-win |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/YanVugenfirer/kvm-guest-drivers-windows/commit/723416fa4210b7464b28eab89cc76252e6193ac1
- https://github.com/YanVugenfirer/kvm-guest-drivers-windows/commit/fbfa4d1083ea84c5429992ca3e996d7d4fbc8238
- https://rhn.redhat.com/errata/RHSA-2015-1043.html
- https://rhn.redhat.com/errata/RHSA-2015-1044.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1227634
- https://www.cve.org/CVERecord?id=CVE-2015-3215 https://nvd.nist.gov/vuln/detail/CVE-2015-3215
- https://access.redhat.com/errata/RHSA-2015:1043
- https://access.redhat.com/errata/RHSA-2015:1044
- https://www.redhat.com/security/data/cve/CVE-2015-3215.html
- http://rhn.redhat.com/errata/RHSA-2015-1043.html
- http://rhn.redhat.com/errata/RHSA-2015-1044.html
- collector/redhat-bugzilla
- alias/CVE-2015-3215
- collector/redhat-cve
- agent/type
- agent/remedy
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/author
- agent/severity
- agent/event
- agent/description
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/redhat
- canonical/virtio-win