Bug 1025396 - (CVE-2017-2630) VUL-0: CVE-2017-2630: kvm: qemu: nbd: oob stack write in client routine drop_sync
VUL-0: CVE-2017-2630: kvm: qemu: nbd: oob stack write in client routine drop_...
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
Other Other
: P3 - Medium : Normal
: unspecified
Assigned To: Bruce Rogers
Security Team bot
Depends on:
  Show dependency treegraph
Reported: 2017-02-15 10:15 UTC by Mikhail Kasimov
Modified: 2021-09-30 22:36 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Mikhail Kasimov 2017-02-15 10:15:32 UTC
Ref: http://seclists.org/oss-sec/2017/q1/439

Quick Emulator(Qemu) built with the Network Block Device(NBD) client support is vulnerable to a stack buffer overflow issue. It could occur while processing server's response to a 'NBD_OPT_LIST' request.

A malicious NBD server could use this issue to crash remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the Qemu process.

Upstream patch:
  -> https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg01246.html

  -> https://bugzilla.redhat.com/show_bug.cgi?id=1422415

'CVE-2017-2630' is assigned to this issue by Red Hat Inc.

Thank you.
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

Comment 1 Swamp Workflow Management 2017-02-15 23:00:26 UTC
bugbot adjusting priority
Comment 2 Bruce Rogers 2017-03-17 18:57:41 UTC
This is fixed by upstream commit 2563c9c6b8670400c48e562034b321a7cf3d9a85.
Comment 3 Bruce Rogers 2017-04-28 16:50:05 UTC
This doesn't affect any released SLE qemu packages. The vulnerability is in the v2.8.0 qemu in Factory and Tumbleweed, and is fixed by the queued v2.9.0 based qemu package which is about to be submitted to Factory. Based on that, I'll mark this bug fixed.