Denial Of Service (DoS)

2019-02-0702:24:13

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

69.8%

JSON

libspice.so is vulnerable to denial of service. The vulnerability is possible because the function memslot_get_virt lacks the proper boundary checking for slot_id array in memslot.c, which is calculated using a QXLPHYSICAL address set by the guest QXL driver, thereby allowing an attacker to input malicious values through it to trigger the attack.

CPENameOperatorVersion
libspice.soeq0.0.0.debug
libspice-server.soeq1.12.4
spice-servereq0.8.0__1.el6
spice-servereq0.12.0__12.el6_4.1
spice-servereq0.12.0__12.el6_4.5
spice-servereq0.12.4__13.el6_8.2
spice-servereq0.12.4__6.el6
spice-servereq0.12.4__12.el6_7.1
spice-servereq0.12.4__11.el6
spice-servereq0.12.4__6.el6_5.1

Name	Operator	Version
libspice.so	eq	0.0.0.debug
libspice-server.so	eq	1.12.4
spice-server	eq	0.8.0__1.el6
spice-server	eq	0.12.0__12.el6_4.1
spice-server	eq	0.12.0__12.el6_4.5
spice-server	eq	0.12.4__13.el6_8.2
spice-server	eq	0.12.4__6.el6
spice-server	eq	0.12.4__12.el6_7.1
spice-server	eq	0.12.4__11.el6
spice-server	eq	0.12.4__6.el6_5.1