guest-triggerable out-of-bounds buffer access via IDE SMART command (CVE-2014-2894)

Related Vulnerabilities: CVE-2014-2894  

Debian Bug report logs - #745157
guest-triggerable out-of-bounds buffer access via IDE SMART command (CVE-2014-2894)

version graph

Reported by: Michael Tokarev <mjt@tls.msk.ru>

Date: Fri, 18 Apr 2014 15:03:05 UTC

Severity: serious

Tags: jessie, patch, security, upstream, wheezy

Found in version 1.1.2+dfsg-1

Fixed in version qemu/2.0.0+dfsg-1

Done: <mjt@tls.msk.ru>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>:
Bug#745157; Package qemu-system, qemu-kvm. (Fri, 18 Apr 2014 15:03:10 GMT) (full text, mbox, link).


Acknowledgement sent to Michael Tokarev <mjt@tls.msk.ru>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>. (Fri, 18 Apr 2014 15:03:10 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: guest-triggerable out-of-bounds buffer access via IDE SMART command (CVE-2014-2894)
Date: Fri, 18 Apr 2014 19:00:26 +0400
Package: qemu-system, qemu-kvm
Version: 1.1.2+dfsg-1
Severity: serious
Tags: security upstream patch wheezy jessie

CVE-2014-2894, a guest-triggerable out of bounds memory access using
IDE SMART commands.  This can lead to qemu process memory corruption
and potentially (unlikely) to invalid code execution with host qemu
process privileges.

Introduced past 2009.  Qemu 0.12 (on squeeze, oldstable) is not affected,
wheezy/stable and current testing are affected, fixed in upstream 2.0
which is currently in sid.

/mjt



Marked as fixed in versions qemu/2.0.0+dfsg-1. Request was from <mjt@tls.msk.ru> to control@bugs.debian.org. (Wed, 30 Apr 2014 13:03:05 GMT) (full text, mbox, link).


Marked Bug as done Request was from <mjt@tls.msk.ru> to control@bugs.debian.org. (Wed, 30 Apr 2014 13:03:06 GMT) (full text, mbox, link).


Notification sent to Michael Tokarev <mjt@tls.msk.ru>:
Bug acknowledged by developer. (Wed, 30 Apr 2014 13:03:07 GMT) (full text, mbox, link).


Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Thu, 29 May 2014 07:27:45 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 16:29:03 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.