Denial of service in QEMU

1) Integer overflow

EUVDB-ID: #VU33993

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-5239

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in  the VNC display driver in QEMU. A remote attacker can pass specially crafted CLIENT_CUT_TEXT message to the application, trigger integer overflow and perform a denial of service attack via infinite loop.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

QEMU: 2.0 - 2.0.2

CPE2.3

• cpe:2.3:a:qemu:qemu:2.0:*:*:*:*:*:*:
• cpe:2.3:a:qemu:qemu:2.0.0:*:*:*:*:*:*:
• cpe:2.3:a:qemu:qemu:2.0.1:*:*:*:*:*:*:

External links

http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168077.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168646.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168671.html
http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00026.html
http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00011.html
http://www.openwall.com/lists/oss-security/2015/09/02/7
http://www.ubuntu.com/usn/USN-2745-1
http://github.com/qemu/qemu/commit/f9a70e79391f6d7c2a912d785239ee8effc1922d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to open a a specially crafted file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.