CVE-2015-3215: Input Validation
It was found that the Windows Virtio NIC driver did not sufficiently sanitize the length of the incoming IP packets, as demonstrated by a packet with IP options present but the overall packet length not being adjusted to reflect the length of those options.
A remote attacker able to send a specially crafted IP packet to the guest could use this flaw to crash that guest.
Upstream commits:
https://github.com/YanVugenfirer/kvm-guest-drivers-windows/commit/723416fa4210b7464b28eab89cc76252e6193ac1 https://github.com/YanVugenfirer/kvm-guest-drivers-windows/commit/fbfa4d1083ea84c5429992ca3e996d7d4fbc8238
Acknowledgements:
Red Hat would like to thank Google Project Zero for reporting this issue.
Other sources
The NetKVM Windows Virtio driver allows remote attackers to cause a denial of service (guest crash) via a crafted length value in an IP packet, as demonstrated by a value that does not account for the size of the IP options.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2015-3215?
CVE-2015-3215 has a medium severity rating due to its potential to allow remote code execution via specially crafted packets.
How do I fix CVE-2015-3215?
To fix CVE-2015-3215, update the virtio-win package to version 1.7.4-1.el6_6 or 1.7.4-1.el7.
Who is affected by CVE-2015-3215?
CVE-2015-3215 affects users of the virtio-win driver on Red Hat Enterprise Linux 6 and 7 systems.
What type of attack does CVE-2015-3215 enable?
CVE-2015-3215 enables a remote attacker to send malformed IP packets that can exploit the vulnerability.
What are the symptoms of CVE-2015-3215 exploitation?
Exploitation of CVE-2015-3215 may lead to system crashes or unexpected behavior in the affected virtual network interfaces.