Red Hat update for qemu

Published: 2018-04-13

Risk	Medium
Patch available	YES
Number of vulnerabilities	5
CVE-ID	CVE-2017-13672 CVE-2017-13673 CVE-2017-13711 CVE-2017-15119 CVE-2017-15124
CWE-ID	CWE-125 CWE-20 CWE-416 CWE-400 CWE-789
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Red Hat OpenStack for IBM Power Server applications / Other server solutions Red Hat OpenStack Server applications / Other server solutions
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Out-of-bounds read

EUVDB-ID: #VU11644

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-13672

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows an adjacent unauthenticated attacker to cause DoS condition on the target system.

The weakness exists due to out-of-bounds read. An adjacent attacker can trigger memory corruption and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat OpenStack for IBM Power: 12

Red Hat OpenStack: 8 - 12

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2018:1113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper input validation

EUVDB-ID: #VU11818

Risk: Low

CVSSv3.1: 3.1 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-13673

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows an adjacent authenticated attacker to cause DoS condition on the target system.

The vulnerability exists in the vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode in the cpu_physical_memory_snapshot_get_dirty function due to assertion failure. An adjacent attacker can cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat OpenStack for IBM Power: 12

Red Hat OpenStack: 8 - 12

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2018:1113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free error

EUVDB-ID: #VU11819

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-13711

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists in the Slirp networking implementation due to use-after-free error when a Socket referenced from multiple packets is freed while responding to a message. An adjacent attacker can cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat OpenStack for IBM Power: 12

Red Hat OpenStack: 8 - 12

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2018:1113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Resource exhaustion

EUVDB-ID: #VU11231

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-15119

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to resource exhaustion when sending large option requests, making the server waste CPU time on reading up to 4GB per request. A remote attacker can cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat OpenStack for IBM Power: 12

Red Hat OpenStack: 8 - 12

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2018:1113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Memory allocation

EUVDB-ID: #VU11232

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-15124

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to uncontrolled memory allocation when not throttling the framebuffer updates sent to the client. A remote attacker can cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat OpenStack for IBM Power: 12

Red Hat OpenStack: 8 - 12

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2018:1113

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.