qemu -- denial of service vulnerability in Q35 chipset emulation

ID 152ACFF3-B1BD-11E5-9728-002590263BF5
Type freebsd
Reporter FreeBSD
Modified 2016-07-06T00:00:00


Prasad J Pandit, Red Hat Product Security Team, reports:

Qemu emulator built with the Q35 chipset based pc system emulator is vulnerable to a heap based buffer overflow. It occurs during VM guest migration, as more(16 bytes) data is moved into allocated (8 bytes) memory area. A privileged guest user could use this issue to corrupt the VM guest image, potentially leading to a DoS. This issue affects q35 machine types.