CVE-2017-5856: Medium severity Qemu Qemu vulnerability
Memory leak in the megasashandledcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) via MegaRAID Firmware Interface (MFI) commands with the sglist size set to a value over 2 Gb.
Other sources
Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support is vulnerable to a memory leakage issue. It could occur while processing MegaRAID Firmware Interface(MFI) command in 'megasashandledcmd' routine.
A privileged user inside guest could use this flaw to leak host memory resulting DoS issue.
Upstream patch: --------------- -> http://git.qemu.org/?p=qemu.git;a=commit;h=765a707000e838c30b18d712fe6cb3dd8e0435f3
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/02/01/19
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 765a707000e838c30b18d712fe6cb3dd8e0435f3 - Compensating control
Mitigate by preventing untrusted/privileged guest users from issuing MegaRAID SAS 8708EM2 MegaRAID Firmware Interface (MFI) commands to QEMU (e.g., restrict or isolate guests/tenants that can access the emulated MegaRAID SAS 8708EM2 HBA).
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5856?
The severity of CVE-2017-5856 is considered to be moderate as it can lead to denial of service through memory consumption.
How do I fix CVE-2017-5856?
To fix CVE-2017-5856, you should upgrade to a patched version of QEMU that addresses this memory leak.
Who is affected by CVE-2017-5856?
CVE-2017-5856 affects local privileged users of guest operating systems running QEMU versions up to 2.8.1.1.
What is the nature of the vulnerability in CVE-2017-5856?
CVE-2017-5856 is a memory leak vulnerability that allows abuse of MegaRAID Firmware Interface commands.
What kind of denial of service can CVE-2017-5856 cause?
CVE-2017-5856 can cause denial of service by excessive host memory consumption due to large sglist sizes.