REDHAT-BUG-984769: Medium severity Freedesktop SPICE vulnerability
Currently, both redchannelpipesaddtype() and redchannelpipesaddemptymsg() use plaing RINGFOREACH() which is not safe versus removals from the ring within the loop body. Yet, when (network) error does occur, the current item could be removed from the ring down the road and the assertion in RINGFOREACH()'s ringnext() could trip, causing the process containing the spice server to abort.
An user able to initiate spice connection to the guest could use this flaw to crash the guest.
Upstream fix: http://cgit.freedesktop.org/spice/spice/commit/?id=53488f0275d6c8a121af49f7ac817d09ce68090d
Acknowledgements:
This issue was discovered by David Gibson of Red Hat.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-984769?
The severity of REDHAT-BUG-984769 is classified as medium, with a risk rating of 4.
How do I fix REDHAT-BUG-984769?
To address REDHAT-BUG-984769, it is recommended to review and modify the usage of RING_FOREACH() to ensure safe handling of removals from the loop.
What components are affected by REDHAT-BUG-984769?
REDHAT-BUG-984769 affects components within the Freedesktop SPICE software, specifically the functions red_channel_pipes_add_type() and red_channel_pipes_add_empty_msg().
What are the potential implications of REDHAT-BUG-984769?
The implications of REDHAT-BUG-984769 include possible network errors and unexpected behavior due to unsafe iterations over the ring.
When was REDHAT-BUG-984769 published?
REDHAT-BUG-984769 was published on July 15, 2013.