REDHAT-BUG-1955695: Low severity qemu vulnerability
A flaw was found in the USB redirection support (usb-redir) of QEMU. More specifically, usb-host and usb-redirect try to batch bulk transfers by combining many small USB packets into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk sending is used in usbredirhandlebulkdata() to dynamically allocate a variable length array (VLA) on the stack. Since the total size is not bounded, a malicious guest could be able to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1955695?
The severity of REDHAT-BUG-1955695 is classified as moderate due to potential impact on USB redirection functionality.
How do I fix REDHAT-BUG-1955695?
To fix REDHAT-BUG-1955695, update your QEMU installation to the latest patched version provided by the vendor.
What components are affected by REDHAT-BUG-1955695?
The components affected by REDHAT-BUG-1955695 are the usb-host and usb-redirect functionalities in QEMU.
What kind of vulnerability is REDHAT-BUG-1955695?
REDHAT-BUG-1955695 is a flaw related to batch processing of USB packets in QEMU's USB redirection support.
Who is the vendor for REDHAT-BUG-1955695?
The vendor for REDHAT-BUG-1955695 is QEMU.