Bug#762532: CVE-2014-3640: qemu: slirp: NULL pointer deref in sosendto()

2014-09-24 Thread Henri Salo
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, Sep 23, 2014 at 08:26:03PM +0400, Michael Tokarev wrote: Yes, that's a security fix indeed, but it is, again, of a rather low impact. At max it will lead to qemu process crashing (so a DoS), but the thing is that slirp (aka user-mode

Bug#762532: CVE-2014-3640: qemu: slirp: NULL pointer deref in sosendto()

2014-09-23 Thread Henri Salo
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Package: qemu Version: 2.1+dfsg-4 Severity: important Tags: security, fixed-upstream Hi, When guest sends udp packet with source port and source addr 0, uninitialized socket is picked up when looking for matching and already created udp sockets, and

Bug#762532: CVE-2014-3640: qemu: slirp: NULL pointer deref in sosendto()

2014-09-23 Thread Michael Tokarev
Control: tag -1 + confirmed pending 23.09.2014 10:54, Henri Salo wrote: When guest sends udp packet with source port and source addr 0, uninitialized socket is picked up when looking for matching and already created udp sockets, and later passed to sosendto() where NULL pointer dereference is