Bugzilla – Bug 1177782
VUL-0: CVE-2020-25652: spice-vdagent: possibility to exhaust file descriptors in `vdagentd`
Last modified: 2021-08-23 08:43:12 UTC
Split-off from audit bug 1173749: ## c) Possibility to Exhaust File Descriptors in `vdagentd` `spice-vdagentd` does not apply a limit to the amount of client connections that can be established via the UNIX domain socket in `/run/spice-vdagentd/spice-vdagent-sock`. Also existing connections aren't subject to a timeout or any kind of preconditions for them to stay alive. Thus it is easy to exhaust the file descriptor limit for the `spice-vdagentd` process (typically 1024 file descriptors by default, this limit is also imposed by system calls like `select()`). Any local user in the virtual machine can open around ~1020 connections to `spice-vdagentd` and simply keep them open without transmitting any data. The `spice-vdagentd` will then become unable to open further connections for legitimate clients or perform other tasks (like opening the serial device, see section 2.a, or invoking systemd library calls that require opening files). ### Impact By exhausting file descriptors in `spice-vdagentd` the following effects can be achieved: - The attack can prevent legitimate `spice-vdagent` instances from connecting to the `spice-vdagentd`. SPICE features won't be available to affected sessions. - The attack can cause `vdagentd` to exit on error conditions if tuned carefully. For example, an attacker can exhaust all file descriptors in `spice-vdagentd` except for one and then wait for a legitimate client from an active session to connect. This connection attempt will succeed, but the subsequent attempt to open the serial device (see section 2.a) will fail, and `spice-vdagentd` will exit. This will then also cause the involved `spice-vdagent` to exit, because the connection to the system daemon is lost. - `spice-vdagentd` will enter a 100 % CPU infinite loop, because it tries to `accept()` the new connection, which is impossible, but also doesn't close the listening socket or abort execution. - This attack vector makes security issue 3.d better exploitable, which will be explained there in more detail.
SUSE-SU-2020:3268-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1173749,1177780,1177781,1177782,1177783 CVE References: CVE-2020-25650,CVE-2020-25651,CVE-2020-25652,CVE-2020-25653 JIRA References: Sources used: SUSE Linux Enterprise Module for Desktop Applications 15-SP2 (src): spice-vdagent-0.19.0-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:1898-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1173749,1177780,1177781,1177782,1177783 CVE References: CVE-2020-25650,CVE-2020-25651,CVE-2020-25652,CVE-2020-25653 JIRA References: Sources used: openSUSE Leap 15.2 (src): spice-vdagent-0.19.0-lp152.2.3.1
Submitted to SUSE:SLE-15-SP1:Update with SR#246273 Submitted to SUSE:SLE-15:Update 246274 Submitted to SUSE:SLE-12-SP5:Update with SR#246275 Submitted to SUSE:SLE-12-SP4:Update with SR#246276 Submitted to SUSE:SLE-12-SP3:Update with SR#246277 Submitted to SUSE:SLE-12-SP2:Update with SR#246278
SUSE-SU-2021:2614-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1173749,1177780,1177781,1177782,1177783 CVE References: CVE-2020-25650,CVE-2020-25651,CVE-2020-25652,CVE-2020-25653 JIRA References: Sources used: SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src): spice-vdagent-0.21.0-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:2766-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1177780,1177781,1177782,1177783 CVE References: CVE-2020-25650,CVE-2020-25651,CVE-2020-25652,CVE-2020-25653 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP5 (src): spice-vdagent-0.16.0-8.8.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:2803-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1177780,1177781,1177782,1177783 CVE References: CVE-2020-25650,CVE-2020-25651,CVE-2020-25652,CVE-2020-25653 JIRA References: Sources used: SUSE Manager Server 4.0 (src): spice-vdagent-0.17.0-4.3.1 SUSE Manager Retail Branch Server 4.0 (src): spice-vdagent-0.17.0-4.3.1 SUSE Manager Proxy 4.0 (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise Server for SAP 15-SP1 (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise Server for SAP 15 (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise Server 15-LTSS (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): spice-vdagent-0.17.0-4.3.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): spice-vdagent-0.17.0-4.3.1 SUSE Enterprise Storage 6 (src): spice-vdagent-0.17.0-4.3.1 SUSE CaaS Platform 4.0 (src): spice-vdagent-0.17.0-4.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Released.