|Public release ||2013-10-02 15:00|
|Updated ||2013-10-02 16:23|
|Title ||qemu SCSI REPORT LUNS buffer overflow|
Filesadvisory-65.txt (signed advisory file)
-----BEGIN PGP SIGNED MESSAGE-----
Xen Security Advisory CVE-2013-4344 / XSA-65
qemu SCSI REPORT LUNS buffer overflow
UPDATES IN VERSION 2
qemu contains a possible buffer overflow in the SCSI code that
implements the REPORT LUNS command. The buffer can be overflowed by
creating a SCSI controller with more than 256 attached devices (such
as disks) and sending a REPORT LUNS command with a short transfer
buffer (less than 2056 bytes).
Xen systems do not use the qemu SCSI code by default.
On Xen systems where the device_model_args (or equivalent) parameters
have been used to configure a SCSI controller for a guest, with more
than 256 devices, a malicious guest might be able to escalate its
privilege to that of the qemu process in the host (typically root).
Only Xen systems whose administrators have deliberately configured HVM
guests to have emulated SCSI controllers, and where those guests are
provided with more than 256 devices, are vulnerable.
We are not aware of any such systems.
MITIGATION AND RESOLUTION
Please refer to the advisories and information from the Qemu project.
If, during the embargo period, you have any questions about this
advisory in the context of Xen, please contact the Xen Project
This issue was reported to us by the Qemu project.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
-----END PGP SIGNATURE-----
Xenproject.org Security Team