CVE-2019-15890: Use After Free
A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. It occurs in ipreass() routine while reassembling incoming packets, if the first fragment is bigger than the m->mdat[] buffer.
A user/process could use this flaw to crash the Qemu process on the host resulting in DoS.
Upstream patch: --------------- -> https://gitlab.freedesktop.org/slirp/libslirp/commit/c59279437eda91841b9d26079c70b8a540d41204
Other sources
A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. The issue occurs in ipreass() routine while reassembling incoming packets, if the first fragment is bigger than the m->mdat[] buffer. A user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ipreass in ipinput.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 2:0.12.1.2-2.506.el6_10.6 - Upgrade
Upgrade
redhat/slirp4netnsto a version that resolves this vulnerability.Fixed in 0:0.3.0-8.el7_7 - Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u5Fixed in 1:7.2+dfsg-7+deb12u18Fixed in 1:7.2+dfsg-7+deb12u15Fixed in 1:10.0.7+ds-0+deb13u1Fixed in 1:10.0.2+ds-2+deb13u1Fixed in 1:10.2.1+ds-1 - Upgrade
Upgrade
debian/slirp4netnsto a version that resolves this vulnerability.Fixed in 1.0.1-2Fixed in 1.2.0-1Fixed in 1.2.1-1.1Fixed in 1.3.3-1 - Upgrade
Upgrade
libslirp (used by QEMU)to a version that resolves this vulnerability.Fixed in 4.0.0Patch c59279437eda91841b9d26079c70b8a540d41204
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-15890?
CVE-2019-15890 is a vulnerability in libslirp 4.0.0 as used in QEMU 4.1.0 that allows a use-after-free issue in the SLiRP networking implementation.
What is the severity of CVE-2019-15890?
The severity of CVE-2019-15890 is high, with a severity value of 7.5.
How does CVE-2019-15890 affect the affected software?
CVE-2019-15890 affects QEMU versions 4.1.0 and libslirp version 4.0.0.
What is the remedy for CVE-2019-15890?
Apply the provided updates or patches from the respective software vendors.
Where can I find more information about CVE-2019-15890?
More information about CVE-2019-15890 can be found at the provided references.