Re: [Qemu-devel] [PATCH] input: limit kbd queue depth

["Daniel P. Berrange" <berrange@redhat.com>]

On Fri, Apr 28, 2017 at 10:42:37AM +0200, Gerd Hoffmann wrote:
> Apply a limit to the number of items we accept into the keyboard queue.

Is there a need for similar protection fir mouse input events from VNC ?

> Impact: Without this limit vnc clients can exhaust host memory by
> sending keyboard events faster than qemu feeds them to the guest.

Ability for a remote network client to crash a host by exhausting
memory should be considered a security flaw & have a CVE allocated
for it.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|