FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

qemu -- denial of service vulnerability in Q35 chipset emulation

Affected packages
	qemu	<	2.5.50
	qemu-devel	<	2.5.50
	qemu-sbruno	<	2.5.50.g20151224
	qemu-user-static	<	2.5.50.g20151224

Details

VuXML ID	152acff3-b1bd-11e5-9728-002590263bf5
Discovery	2015-11-19
Entry	2016-01-03
Modified	2016-07-06

Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the Q35 chipset based pc system emulator is vulnerable to a heap based buffer overflow. It occurs during VM guest migration, as more(16 bytes) data is moved into allocated (8 bytes) memory area.

A privileged guest user could use this issue to corrupt the VM guest image, potentially leading to a DoS. This issue affects q35 machine types.

[source]

References

CVE Name	CVE-2015-8666
URL	http://git.qemu.org/?p=qemu.git;a=commit;h=d9a3b33d2c9f996537b7f1d0246dee2d0120cefb
URL	http://www.openwall.com/lists/oss-security/2015/12/24/1
URL	https://github.com/seanbruno/qemu-bsd-user/commit/d9a3b33d2c9f996537b7f1d0246dee2d0120cefb