A flaw was found in the way the QEMU-KVM handled erroneous data provided by the guest Linux virtio-net driver. Due deficiency in the implementation of the TSO (TCP segment offloading), the guest's virtio-net driver transmitted improper data to the particular QEMU-KVM process on the host, resulting in its termination. A remote attacker could use this flaw to cause denial of service (guest crash) by sending certain, specially-crafted data to arbitrary open port on the target guest system.

A remote attacker could exploit this to crash guests which use virtio networking on Linux kernels earlier than 2.6.26.

Paolo Bonzini found a bug in KVM that can be used to bypass proper permission checking while loading segment selectors. Malicious guest userspace process running in SMP guest can trick the emulator into loading kernel segment selector if it has access to IO port or MMIO region. To do so it should run legitimate instruction that does IO and will cause vcpu to enter emulator in one thread and replace this instruction to kernel selector loading one from another thread. If instruction is replaced after KVM entered emulator, but before instruction is fetched emulator will be tricked to execute privileged instruction without permission checking.

Gleb Napatov found a bug in KVM that can be used to bypass proper IOPL/CPL checking. KVM relies on CPU to check IOPL/CPL before instruction execution, so emulator doesn't do IOPL/CPL checking. Malicious guest process running in SMP guest can bypass CPU IOPL/CPL checking if it has access to IO port or MMIO region. To do so it should run legitimate instruction that does IO and will cause vcpu to enter emulator in one thread and replace this instruction to malicious one from another thread. If instruction is replaced after KVM entered emulator, but before instruction is fetched emulator will be tricked to execute privileged instruction without permission checking.

The protocolclientmsg function in vnc.c in the VNC server in (1) Qemu 0.9.1 and earlier and (2) KVM kvm-79 and earlier allows remote attackers to cause a denial of service (infinite loop) via a certain message.

Created attachment 320281 [details] Proposed actualized upstream qemu patch to resolve the Cirrus LGD-54XX "bitblt" heap overflow (CVE-2007-1320)

Jan Niehusmann discovered that the upstream fix for the CVE-2007-1320 is incomplete and still allows local users to cause a heap-based buffer overlow, when connecting via the VNC console.

Steps to reproduce:

No reproducer.

Upstream qemu patch for the initial CVE-2007-1320 issue: https://svn.pardus.org.tr/pardus/2007/applications/emulators/qemu/files/CVE-2007-1320.patch

Proposed upstream correction of this patch - see attachment.