slirp4netns: CVE-2019-15890

Debian Bug report logs - #939868
slirp4netns: CVE-2019-15890

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: slirp4netns: CVE-2019-15890

Date: Mon, 09 Sep 2019 17:41:36 +0200

Source: slirp4netns
Version: 0.3.2-1
Severity: grave
Tags: security upstream
Justification: user security hole
Control: clone -1 -2
Control: reassign -2 src:qemu 1:4.1-1
Control: retitle -2 qemu: CVE-2019-15890

Hi,

The following vulnerability was published for slirp4netns.

CVE-2019-15890[0]:
| libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in
| ip_reass in ip_input.c.

I'm filling this with higher serverity as you proably would have
expected, but for buster and older I guess we can follow this as
no-dsa and schedule fixes via point releases or include in future
DSAs. As unprivileged user namespaces are not enabled by default the
former holds surely for slirp4netns itself. The bug is cloned as well
for qemu.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-15890
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15890
[1] https://www.openwall.com/lists/oss-security/2019/09/06/3
[2] https://gitlab.freedesktop.org/slirp/libslirp/commit/c59279437eda91841b9d26079c70b8a540d41204

Please adjust the affected versions in the BTS as needed, only looked
at the respective unstable versions.

Regards,
Salvatore

Send a report that this bug log contains spam.