CVE-2015-5154

Impact:
Important
Public Date:
2015-07-27
CWE:
CWE-119
Bugzilla:
1243563: CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access
A heap buffer overflow flaw was found in the way QEMU's IDE subsystem handled I/O buffer access while processing certain ATAPI commands. A privileged guest user in a guest with the CDROM drive enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.

Find out more about CVE-2015-5154 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

This issue does not affect the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5, the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6 and the Red Hat Enterprise Linux 6 based qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3, because they did not backport the upstream commit that introduced this issue.

This issue does affect the versions of qemu-kvm packages as shipped with Red Hat Enterprise Linux 7 and versions of Red Hat Enterprise Linux 7 based qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3. Future updates for the respective releases will address this flaw.

CVSS v2 metrics

Base Score 6.5
Base Metrics AV:A/AC:H/Au:S/C:C/I:C/A:C
Access Vector Adjacent Network
Access Complexity High
Authentication Single
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts (qemu-kvm-rhev) RHSA-2015:1508 2015-07-27
Red Hat Enterprise Linux 7 (qemu-kvm) RHSA-2015:1507 2015-07-27
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 (qemu-kvm-rhev) RHSA-2015:1512 2015-07-28
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 (qemu-kvm-rhev) RHSA-2015:1512 2015-07-28

Affected Packages State

Platform Package State
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 qemu-kvm-rhev Not affected
Red Hat Enterprise Linux 6 qemu-kvm Not affected
Red Hat Enterprise Linux 5 xen Not affected
Red Hat Enterprise Linux 5 kvm Not affected
RHEV Manager 3 rhev-hypervisor Affected
Unless explicitly stated as not affected, all previous versions of packages in any minor update stream of a product listed here should be assumed vulnerable, although may not have been subject to full analysis.

Acknowledgements

This issue was discovered by Kevin Wolf of Red Hat.
Last Modified