Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker, who is privileged in a guest system, can generate a
buffer overflow in acpi_gpe_init() of QEMU, in order to trigger a
denial of service of the VM.

Impacted products: Fedora, QEMU.

Severity: 1/4.

Creation date: 28/12/2015.

DESCRIPTION OF THE VULNERABILITY

The QEMU product supports the Intel Q35 Express Chipset.

When a VM is migrated, the acpi_gpe_init() function is used by
ACPI (Advanced Configuration and Power Interface) for Q35.
However, the allocated memory is too short.

An attacker, who is privileged in a guest system, can therefore
generate a buffer overflow in acpi_gpe_init() of QEMU, in order to
trigger a denial of service of the VM.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/QEMU-buffer-overflow-of-acpi-gpe-init-18593