CVE-2015-8701

QEMU (aka Quick Emulator) built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit (tx) descriptors in 'tx_consume' routine, if a descriptor was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments. A privileged user inside guest could use this flaw to cause memory leakage on the host or crash the QEMU process instance resulting in DoS issue.

CVSS v3.0 6.5 MEDIUM
CVSS v2.0 2.1 LOW

6.5^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 2.0 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.html	Patch Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1286971	Issue Tracking
http://www.securityfocus.com/bid/79706	Third Party Advisory VDB Entry
http://www.openwall.com/lists/oss-security/2015/12/29/1	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/12/28/6	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201602-01	Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*

Information

Published : 2016-12-29 14:59

Updated : 2020-11-10 10:53

NVD link : CVE-2015-8701

Mitre link : CVE-2015-8701

JSON object : View

CWE

CWE-193

Off-by-one Error

Advertisement

Products Affected

qemu

qemu

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg04629.html", "name": "[qemu-devel] 20151226 [PATCH v2] net: rocker: fix an incorrect array bounds check", "tags": ["Patch", "Vendor Advisory"], "refsource": "MLIST"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1286971", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1286971", "tags": ["Issue Tracking"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/79706", "name": "79706", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.openwall.com/lists/oss-security/2015/12/29/1", "name": "[oss-security] 20151229 Re: CVE request Qemu net: rocker: fix an incorrect array bounds check", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2015/12/28/6", "name": "[oss-security] 20151228 CVE request Qemu net: rocker: fix an incorrect array bounds check", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "https://security.gentoo.org/glsa/201602-01", "name": "GLSA-201602-01", "tags": ["Third Party Advisory"], "refsource": "GENTOO"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "QEMU (aka Quick Emulator) built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit (tx) descriptors in 'tx_consume' routine, if a descriptor was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments. A privileged user inside guest could use this flaw to cause memory leakage on the host or crash the QEMU process instance resulting in DoS issue."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-193"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2015-8701", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "severity": "LOW", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.0}}, "publishedDate": "2016-12-29T22:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.5.1.1"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-11-10T18:53Z"}