Bug 1025396 – VUL-0: CVE-2017-2630: kvm: qemu: nbd: oob stack write in client routine drop_sync

Bug 1025396 - (CVE-2017-2630) VUL-0: CVE-2017-2630: kvm: qemu: nbd: oob stack write in client routine drop_sync

(CVE-2017-2630)
Summary:	VUL-0: CVE-2017-2630: kvm: qemu: nbd: oob stack write in client routine drop_...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	unspecified
Assigned To:	Bruce Rogers
QA Contact:	Security Team bot

URL:
Whiteboard:	CVSSv2:RedHat:CVE-2017-2630:4.6:(AV:N...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2017-02-15 10:15 UTC by Mikhail Kasimov
Modified:	2021-09-30 22:36 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	---
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Mikhail Kasimov 2017-02-15 10:15:32 UTC

Ref: http://seclists.org/oss-sec/2017/q1/439
==============================================
  Hello,

Quick Emulator(Qemu) built with the Network Block Device(NBD) client support is vulnerable to a stack buffer overflow issue. It could occur while processing server's response to a 'NBD_OPT_LIST' request.


A malicious NBD server could use this issue to crash remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the Qemu process.


Upstream patch:
---------------
  -> https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg01246.html

Reference:
----------
  -> https://bugzilla.redhat.com/show_bug.cgi?id=1422415

'CVE-2017-2630' is assigned to this issue by Red Hat Inc.

Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F


==============================================

Comment 1 Swamp Workflow Management 2017-02-15 23:00:26 UTC

bugbot adjusting priority

Comment 2 Bruce Rogers 2017-03-17 18:57:41 UTC

This is fixed by upstream commit 2563c9c6b8670400c48e562034b321a7cf3d9a85.

Comment 3 Bruce Rogers 2017-04-28 16:50:05 UTC

This doesn't affect any released SLE qemu packages. The vulnerability is in the v2.8.0 qemu in Factory and Tumbleweed, and is fixed by the queued v2.9.0 based qemu package which is about to be submitted to Factory. Based on that, I'll mark this bug fixed.