Bug 948976 (CVE-2015-5261) - VUL-0: CVE-2015-5261 spice: host memory access from guest using crafted images
Summary: VUL-0: CVE-2015-5261 spice: host memory access from guest using crafted images
Status: RESOLVED FIXED
Alias: CVE-2015-5261
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Cédric Bosdonnat
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/157360/
Whiteboard: CVSSv2:RedHat:CVE-2015-5261:4.3:(AV:A...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-10-06 09:48 UTC by Andreas Stieger
Modified: 2016-06-13 11:07 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2015-10-06 09:48:47 UTC 
It is possible for a guest issuing QXL commands to host to allow reading and writing host memory in a range of about 16-20gb.
The guest can create a surface very large (say 1000000 x 1000000). If width * height overflow the 32 bit and became a small number the host will accept the command and will create the surface. Now guest can copy areas of surfaces to access any area of memory covered by the image. Considering overflows, pixman implementation and image formats (32 bit, top-down or down-top) the range (the guest pass an offset into video memory for the start) the range if about +/- 8gb.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1261889
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5261
http://seclists.org/oss-sec/2015/q4/40
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5261

No public patch available atm.
Comment 1 Andreas Stieger 2015-10-06 11:13:17 UTC 
patches are public at
http://lists.freedesktop.org/archives/spice-devel/2015-October/022168.html
Comment 2 Bernhard Wiedemann 2015-10-06 16:00:23 UTC 
This is an autogenerated message for OBS integration:
This bug (948976) was mentioned in
https://build.opensuse.org/request/show/336760 Leap:42.1 / spice
Comment 3 Bernhard Wiedemann 2015-10-07 12:00:16 UTC 
This is an autogenerated message for OBS integration:
This bug (948976) was mentioned in
https://build.opensuse.org/request/show/336979 Factory / spice
Comment 4 Swamp Workflow Management 2015-10-14 08:10:02 UTC 
SUSE-SU-2015:1733-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 944460,948976
CVE References: CVE-2015-3247,CVE-2015-5260,CVE-2015-5261
Sources used:
SUSE Linux Enterprise Software Development Kit 12 (src):    spice-0.12.4-8.5.1
SUSE Linux Enterprise Server 12 (src):    spice-0.12.4-8.5.1
SUSE Linux Enterprise Desktop 12 (src):    spice-0.12.4-8.5.1
Comment 5 Swamp Workflow Management 2015-10-15 08:10:40 UTC 
openSUSE-SU-2015:1750-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 848279,944460,944787,948976
CVE References: CVE-2013-4282,CVE-2015-3247,CVE-2015-5260,CVE-2015-5261
Sources used:
openSUSE 13.2 (src):    spice-0.12.4-4.6.1
openSUSE 13.1 (src):    spice-0.12.4-2.3.1
Comment 7 Marcus Meissner 2016-03-21 13:59:18 UTC 
can you also submit for sle11 sp4 spice?
Comment 9 Marcus Meissner 2016-05-07 08:22:37 UTC 
released
Comment 10 Swamp Workflow Management 2016-05-07 11:08:20 UTC 
SUSE-SU-2016:1259-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 944460,944787,948976
CVE References: CVE-2015-3247,CVE-2015-5260,CVE-2015-5261
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    spice-0.12.4-5.1
SUSE Linux Enterprise Server 11-SP4 (src):    spice-0.12.4-5.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    spice-0.12.4-5.1
Comment 12 Swamp Workflow Management 2016-06-13 11:07:58 UTC 
SUSE-SU-2016:1559-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 944787,948976,982385,982386
CVE References: CVE-2015-5260,CVE-2015-5261,CVE-2016-0749,CVE-2016-2150
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    spice-0.12.5-4.1
SUSE Linux Enterprise Server 12-SP1 (src):    spice-0.12.5-4.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    spice-0.12.5-4.1