CVE-2019-14378: Buffer Overflow
A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. It occurs in ipreass() routine while reassembling incoming packets, if the first fragment is bigger than the m->mdat[] buffer.
A user/process could use this flaw to crash the Qemu process on the host resulting in DoS or potentially execute arbitrary code with privileges of the QEMU process.
Upstream patch: --------------- -> https://gitlab.freedesktop.org/slirp/libslirp/commit/126c04acbabd7ad32c2b018fe10dfac2a3bc1210
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/08/01/2
Other sources
A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the ipreass() routine while reassembling incoming packets if the first fragment is bigger than the m->mdat[] buffer. An attacker could use this flaw to crash the QEMU process on the host, resulting in a Denial of Service or potentially executing arbitrary code with privileges of the QEMU process.
ipreass in ipinput.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-14378?
CVE-2019-14378 is a heap buffer overflow vulnerability in the SLiRP networking implementation of the QEMU emulator.
What is the severity of CVE-2019-14378?
CVE-2019-14378 has a severity score of 8.8, which is considered high.
Which software is affected by CVE-2019-14378?
The software affected by CVE-2019-14378 includes qemu-kvm, qemu-kvm-ma, qemu-kvm-rhev, slirp4netns, and qemu.
How can I fix CVE-2019-14378?
To fix CVE-2019-14378, update the affected software to the corresponding patched version provided by the vendor.
Where can I find more information about CVE-2019-14378?
You can find more information about CVE-2019-14378 on the Debian security tracker and MITRE's CVE database.