CVE-2015-5260: Buffer Overflow
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands related to the surfaceid parameter.
Other sources
surfaceid is a field for many QXL commands (commands that a guest can freely craft and send). Particularly are used to create and destroy new surfaces. This field is used as an index for a static allocated array. In different paths, the value passes without being stopped (in many cases it just give some warnings if enabled) so you can corrupt memory very easily. A client can be modified to produce memory corruption. Although it is not easy to write specific data at a specific offset, it is still possible to write some value at some offset (dirtying near data). This means that the problem can be used for heap corruption which is usually exploitable.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5260?
CVE-2015-5260 has a severity rating that can lead to denial of service and potential arbitrary code execution.
How do I fix CVE-2015-5260?
To fix CVE-2015-5260, you should upgrade to SPICE version 0.12.6 or later.
What software is affected by CVE-2015-5260?
CVE-2015-5260 affects various versions of SPICE, Red Hat Enterprise Linux, Debian, and Ubuntu.
What kind of attacks can CVE-2015-5260 enable?
CVE-2015-5260 can enable heap-based memory corruption and crash of QEMU-KVM.
Is CVE-2015-5260 exploitable remotely?
Yes, CVE-2015-5260 can potentially be exploited by guest OS users to compromise the host.