REDHAT-BUG-1749716: Use After Free
A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. It occurs in ipreass() routine while reassembling incoming packets, if the first fragment is bigger than the m->mdat[] buffer.
A user/process could use this flaw to crash the Qemu process on the host resulting in DoS.
Upstream patch: --------------- -> https://gitlab.freedesktop.org/slirp/libslirp/commit/c59279437eda91841b9d26079c70b8a540d41204
Affected Software
Event History
Frequently Asked Questions
Who could exploit this issue?
A user or process able to send crafted incoming packet fragments through QEMU's SLiRP networking can trigger the flaw. The stated impact is a crash of the QEMU process on the host, resulting in denial of service.
What packet condition triggers the crash?
The issue occurs during packet reassembly in ip_reass() when the first fragment is larger than the m->m_dat[] buffer.
What can be done if patching is not immediately possible?
The provided data does not specify a workaround. Reducing or restricting untrusted users' and processes' ability to send traffic through QEMU SLiRP networking would limit exposure to the described trigger.