Bugzilla – Bug 1177780
VUL-0: CVE-2020-25650: spice-vdagent: memory DoS via arbitrary entries in `active_xfers` hash table
Last modified: 2021-08-23 08:43:00 UTC
Split-off from audit bug 1173749 ## a) Memory DoS via Arbitrary Entries in `active_xfers` Hash Table The `spice-vdagentd` maintains a hash map named `active_xfers` that maps `task_ids` to UNIX domain socket connections they belong to. These `task_ids` refer to ongoing file transfers from the host to the virtual machine. An arbitrary client connected to `spice-vdagentd` via a UNIX domain socket can trigger an entry into this hash map, without the requirement that the client is associated with the currently active graphical session (function `do_agent_file_xfer_status`, specifically `vdagentd.c:1025`). There is no limit on the maximum amount of file transfers ongoing in parallel and there are no timeouts applied for a file transfer to be finished. Therefore any unprivileged local user with access to the `/run/spice-vdagentd/spice-vdagent-sock` socket path can perform a memory denial-of-service by entering a large amount of entries into this hash map.
SUSE-SU-2020:3268-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1173749,1177780,1177781,1177782,1177783 CVE References: CVE-2020-25650,CVE-2020-25651,CVE-2020-25652,CVE-2020-25653 JIRA References: Sources used: SUSE Linux Enterprise Module for Desktop Applications 15-SP2 (src): spice-vdagent-0.19.0-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:1898-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1173749,1177780,1177781,1177782,1177783 CVE References: CVE-2020-25650,CVE-2020-25651,CVE-2020-25652,CVE-2020-25653 JIRA References: Sources used: openSUSE Leap 15.2 (src): spice-vdagent-0.19.0-lp152.2.3.1
Submitted to SUSE:SLE-15-SP1:Update with SR#246273 Submitted to SUSE:SLE-15:Update 246274 Submitted to SUSE:SLE-12-SP5:Update with SR#246275 Submitted to SUSE:SLE-12-SP4:Update with SR#246276 Submitted to SUSE:SLE-12-SP3:Update with SR#246277 Submitted to SUSE:SLE-12-SP2:Update with SR#246278
openSUSE-SU-2021:2614-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1173749,1177780,1177781,1177782,1177783 CVE References: CVE-2020-25650,CVE-2020-25651,CVE-2020-25652,CVE-2020-25653 JIRA References: Sources used: openSUSE Leap 15.3 (src): spice-vdagent-0.21.0-3.3.1
SUSE-SU-2021:2614-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1173749,1177780,1177781,1177782,1177783 CVE References: CVE-2020-25650,CVE-2020-25651,CVE-2020-25652,CVE-2020-25653 JIRA References: Sources used: SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src): spice-vdagent-0.21.0-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:2766-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1177780,1177781,1177782,1177783 CVE References: CVE-2020-25650,CVE-2020-25651,CVE-2020-25652,CVE-2020-25653 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP5 (src): spice-vdagent-0.16.0-8.8.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:2803-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1177780,1177781,1177782,1177783 CVE References: CVE-2020-25650,CVE-2020-25651,CVE-2020-25652,CVE-2020-25653 JIRA References: Sources used: SUSE Manager Server 4.0 (src): spice-vdagent-0.17.0-4.3.1 SUSE Manager Retail Branch Server 4.0 (src): spice-vdagent-0.17.0-4.3.1 SUSE Manager Proxy 4.0 (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise Server for SAP 15-SP1 (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise Server for SAP 15 (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise Server 15-LTSS (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): spice-vdagent-0.17.0-4.3.1 SUSE Enterprise Storage 6 (src): spice-vdagent-0.17.0-4.3.1 SUSE CaaS Platform 4.0 (src): spice-vdagent-0.17.0-4.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Released.