CVE-2019-20382: Low severity Qemu Qemu vulnerability
A memory leakage flaw was found in the way the VNC display driver of QEMU handled the connection disconnect when ZRLE and Tight encoding are enabled. Two VncState objects are created, and one allocates memory for the Zlib's data object. This allocated memory is not freed upon disconnection, resulting in a memory leak. An attacker able to connect to the VNC server could use this flaw to leak host memory, leading to a potential denial of service.
Other sources
A memory leakage flaw was found in the way VNC display driver of QEMU handled connection disconnect, when ZRLE, Tight encoding is enabled. It creates two vncState objects, one of which allocates memory for Zlib's data object. This allocated memory is not free'd upon disconnection resulting in the said memory leakage issue. A user able to connect to the VNC server could use this flaw to leak host memory leading to a potential DoS scenario.
Upstream patch: --------------- -> https://git.qemu.org/?p=qemu.git;a=commitdiff;h=6bf21f3d83e95bcc4ba35a7a07cc6655e8b010b0
— Red Hat
QEMU 4.1.0 has a memory leak in zrlecompressdata in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-20382?
CVE-2019-20382 is a vulnerability found in QEMU 4.1.0 that leads to a memory leak in the VNC display driver when ZRLE and Tight encoding are enabled.
What is the severity of CVE-2019-20382?
The severity of CVE-2019-20382 is low, with a CVSS score of 3.5.
How can I fix CVE-2019-20382?
To fix CVE-2019-20382, you should update to QEMU version 4.2.0 or later.
Where can I find more information about CVE-2019-20382?
You can find more information about CVE-2019-20382 in the references provided: [link1], [link2], [link3].