QEMU (aka Quick Emulator) built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit (tx) descriptors in 'tx_consume' routine, if a descriptor was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments. A privileged user inside guest could use this flaw to cause memory leakage on the host or crash the QEMU process instance resulting in DoS issue.

- CVE-2015-8745: vmxnet3: don't assert reading registers     in bar0 (bz #1295442) * CVE-2015-8567: net: vmxnet3:
    host memory leakage (bz #1289818) * CVE-2016-1922: i386:
    avoid NULL pointer dereference (bz #1292766) *     CVE-2015-8613: buffer overflow in megasas_ctrl_get_info     (bz #1284008) * CVE-2015-8701: Buffer overflow in     tx_consume in rocker.c (bz #1293720) * CVE-2015-8743:
    ne2000: OOB memory access in ioport r/w functions (bz     #1294787) * CVE-2016-1568: Use-after-free vulnerability     in ahci (bz #1297023) * Fix modules.d/kvm.conf example     syntax (bz #1298823)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201602-01 (QEMU: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in QEMU. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker might cause a Denial of Service or gain escalated       privileges from a guest VM.
  Workaround :

    There is no known workaround at this time.

Prasad J Pandit, Red Hat Product Security Team, reports :

Qemu emulator built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit(tx) descriptors in 'tx_consume' routine, if a descriptor was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments.

A privileged user inside guest could use this flaw to cause memory leakage on the host or crash the Qemu process instance resulting in DoS issue.

ID	Name	Product	Family	Severity
89526	Fedora 23 : qemu-2.4.1-6.fc23 (2016-42778e8c82)	Nessus	Fedora Local Security Checks	high
88587	GLSA-201602-01 : QEMU: Multiple vulnerabilities (Venom)	Nessus	Gentoo Local Security Checks	critical
87686	FreeBSD : qemu -- denial of service vulnerability in Rocker switch emulation (1384f2fd-b1be-11e5-9728-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-8701

medium

Tenable Plugins

high

critical

medium