CVE-2015-7549

Impact:
Low
Public Date:
2015-10-24
CWE:
CWE-476
Bugzilla:
1291137: CVE-2015-7549 Qemu: pci: null pointer dereference issue
A NULL pointer dereference vulnerability was found in the QEMU emulator built with PCI MSI-X support. Because MSI-X MMIO support did not define the .write method, when the controller tried to write to the pending bit array(PBA) memory region, a segmentation fault occurred. A privileged attacker inside the guest could use this flaw to crash the QEMU process resulting in denial of service.

Find out more about CVE-2015-7549 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

This issue does not affect the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5.

This issue does not affect the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6, and the Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.

This issue affects the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 7.

This issue affects the Red Hat Enterprise Linux 7 based versions of the qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.

This has been rated as having Low security impact and is not currently
planned to be addressed in future updates. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/.

CVSS v2 metrics

NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.

Base Score 2.3
Base Metrics AV:A/AC:M/Au:S/C:N/I:N/A:P
Access Vector Adjacent Network
Access Complexity Medium
Authentication Single
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Affected Packages State

Platform Package State
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 qemu-kvm-rhev Will not fix
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 qemu-kvm-rhev Will not fix
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) qemu-kvm-rhev Will not fix
Red Hat Enterprise Linux 7 qemu-kvm Will not fix
Red Hat Enterprise Linux 6 qemu-kvm Not affected
Red Hat Enterprise Linux 5 kvm Not affected
Red Hat Enterprise Linux 5 xen Not affected

Acknowledgements

This issue was reported by Qinghao Tang of QIHU 360 Marvel Team.

Last Modified
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.