CVE-2015-8619

Impact:
Low
Public Date:
2015-12-17
CWE:
CWE-121
Bugzilla:
1283926: CVE-2015-8619 Qemu: hmp: stack based OOB write in hmp_sendkey routine
An out-of-bounds write vulnerability has been found in the QEMU emulator built with Human Monitor Interface(HMP) support. The issue occurs when the 'sendkey' command (in hmp_sendkey) is processed with a 'keyname_len' that is greater than the 'keyname_buf' array size. A user or process could exploit this flaw to crash the QEMU process instance (denial of service).

Find out more about CVE-2015-8619 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

This issue does not affect the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5.

This issue does not affect the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6, and the Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.

This issue does not affect the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 7.

This issue affects the Red Hat Enterprise Linux 7 based versions of the qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.

This has been rated as having Low security impact and is not currently
planned to be addressed in future updates. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/.

CVSS v2 metrics

NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.

Base Score 2.9
Base Metrics AV:A/AC:M/Au:N/C:N/I:N/A:P
Access Vector Adjacent Network
Access Complexity Medium
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Affected Packages State

Platform Package State
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 qemu-kvm-rhev Will not fix
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 qemu-kvm-rhev Not affected
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) qemu-kvm-rhev Not affected
Red Hat Enterprise Linux 7 qemu-kvm Not affected
Red Hat Enterprise Linux 6 qemu-kvm Not affected
Red Hat Enterprise Linux 5 kvm Not affected

Acknowledgements

Red Hat would like to thank Ling Liu of Qihoo 360 Inc. for reporting this issue.

Last Modified
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.