REDHAT-BUG-1749716: Use After Free

Published Sep 6, 2019

Updated

A use-after-free issue was found in the SLiRP networking implementation of the QEMU emulator. It occurs in ipreass() routine while reassembling incoming packets, if the first fragment is bigger than the m->mdat[] buffer.

A user/process could use this flaw to crash the Qemu process on the host resulting in DoS.

Upstream patch: --------------- -> https://gitlab.freedesktop.org/slirp/libslirp/commit/c59279437eda91841b9d26079c70b8a540d41204

Affected Software

1 affected component

Qemu Qemu

Event History

Sep 6, 2019

Data Sourced

via Red Hat·10:06 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who could exploit this issue?

A user or process able to send crafted incoming packet fragments through QEMU's SLiRP networking can trigger the flaw. The stated impact is a crash of the QEMU process on the host, resulting in denial of service.

What packet condition triggers the crash?

The issue occurs during packet reassembly in ip_reass() when the first fragment is larger than the m->m_dat[] buffer.

What can be done if patching is not immediately possible?

The provided data does not specify a workaround. Reducing or restricting untrusted users' and processes' ability to send traffic through QEMU SLiRP networking would limit exposure to the described trigger.

REDHAT-BUG-1749716: Use After Free

Affected Software

Event History

Frequently Asked Questions

Who could exploit this issue?

What packet condition triggers the crash?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who could exploit this issue?

What packet condition triggers the crash?

What can be done if patching is not immediately possible?