CVE-2015-5261: Buffer Overflow
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.
Other sources
The following flaw was reported in spice:
It is possible for a guest issuing QXL commands to host to allow reading and writing host memory in a range of about 16-20gb. The guest can create a surface very large (say 1000000 x 1000000). If width height overflow the 32 bit and became a small number the host will accept the command and will create the surface. Now guest can copy areas of surfaces to access any area of memory covered by the image. Considering overflows, pixman implementation and image formats (32 bit, top-down or down-top) the range (the guest pass an offset into video memory for the start) the range if about +/- 8gb.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5261?
CVE-2015-5261 is classified as a high severity vulnerability due to its potential for arbitrary memory access.
How do I fix CVE-2015-5261?
To fix CVE-2015-5261, update SPICE to version 0.12.6 or later.
What systems are affected by CVE-2015-5261?
CVE-2015-5261 affects multiple versions of Ubuntu, Red Hat Enterprise Linux, and Debian.
What type of vulnerability is CVE-2015-5261?
CVE-2015-5261 is a heap-based buffer overflow vulnerability.
Can CVE-2015-5261 be exploited remotely?
Yes, CVE-2015-5261 can be exploited remotely by a guest OS user via QXL commands.