CVE-2019-15034

Description

A buffer overflow flaw was found in the way the Bochs display driver of QEMU handled the PCIe extended configuration space when the device is connected to a PCIe bus. Accessing the PCIe extended config space could overflow the conventional PCI config space buffer due to limited memory allocation. As the PCIe config space is guest writeable, this flaw allows a local attacker to gain access and potentially execute arbitrary code on the host with the privileges of the QEMU process.

Statement

This flaw does not affect the module streamvirt:8.1/qemu-kvm as shipped with RHEL Advanced Virtualization, as it already includes the patch. Several other packages are unaffected because they do not include PCIe support:

  • kvm and xen as shipped with Red Hat Enterprise Linux 5
  • qemu-kvm as shipped with Red Hat Enterprise Linux 6 and 7
  • qemu-kvm-rhev as shipped with Red Hat Enterprise Linux 7
  • virt:rhel/qemu-kvm as shipped with Red Hat Enterprise Linux 8
  • qemu-kvm-rhev as shipped with Red Hat OpenStack Platform 10 and 13

Mitigation

Use `-device bochs-display` as conventional PCI device only.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score5.85.8N/A
Attack VectorLocalLocalN/A
Attack ComplexityHighHighN/A
Privileges RequiredLowLowN/A
User InteractionNoneNoneN/A
ScopeUnchangedUnchangedN/A
ConfidentialityLowLowN/A
Integrity ImpactLowLowN/A
Availability ImpactHighHighN/A

Vector

Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

NVD: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Understanding the Weakness (CWE)

CWE-120

Integrity,Confidentiality,Availability

Technical Impact: Modify Memory; Execute Unauthorized Code or Commands

Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of the product's implicit security policy. This can often be used to subvert any other security service.

Availability

Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU)

Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the product into an infinite loop.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.