From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60337) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZJidJ-000208-7f for qemu-devel@nongnu.org; Mon, 27 Jul 2015 09:39:58 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZJid9-0000MT-Ls for qemu-devel@nongnu.org; Mon, 27 Jul 2015 09:39:57 -0400 Date: Mon, 27 Jul 2015 15:38:51 +0200 From: Kevin Wolf Message-ID: <20150727133851.GB4889@noname.redhat.com> References: <1437998503-1865-1-git-send-email-jsnow@redhat.com> <55B61FC0.9000706@profihost.ag> <55B623E9.40201@redhat.com> <55B6313E.6010302@profihost.ag> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <55B6313E.6010302@profihost.ag> Subject: Re: [Qemu-devel] [Qemu-stable] [PULL 0/3] Cve 2015 5154 patches List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Priebe - Profihost AG Cc: peter.maydell@linaro.org, John Snow , qemu-devel@nongnu.org, qemu-stable@nongnu.org Am 27.07.2015 um 15:25 hat Stefan Priebe - Profihost AG geschrieben: > > Am 27.07.2015 um 14:28 schrieb John Snow: > > > > > > On 07/27/2015 08:10 AM, Stefan Priebe - Profihost AG wrote: > >> > >> Am 27.07.2015 um 14:01 schrieb John Snow: > >>> The following changes since commit f793d97e454a56d17e404004867985622ca1a63b: > >>> > >>> Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging (2015-07-24 13:07:10 +0100) > >>> > >>> are available in the git repository at: > >>> > >>> https://github.com/jnsnow/qemu.git tags/cve-2015-5154-pull-request > >> > >> Any details on this CVE? Is RCE possible? Only if IDE is used? > >> > >> Stefan > >> > > > > It's a heap overflow. The most likely outcome is a segfault, but the > > guest is allowed to continue writing past the end of the PIO buffer at > > its leisure. This makes it similar to CVE-2015-3456. > > > > This CVE can be mitigated unlike CVE-2015-3456 by just removing the > > CD-ROM drive until the patch can be applied. > > Thanks. The seclist article explicitly references xen. So it does not > apply to qemu/kvm? Sorry for asking may be stupid questions. The IDE emulation is shared between Xen and KVM, so both are affected. The reason why the seclist mail only mentions Xen is probably because the Xen security team posted it. Meanwhile there is also a Red Hat CVE page available, which mentions qemu-kvm: https://access.redhat.com/security/cve/CVE-2015-5154 Kevin