Re: CVE request Qemu: net: eepro100 memory leakage at device unplug

[<cve-assign () mitre org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> Quick Emulator(Qemu) built with the i8255x (PRO100) NIC emulation support is
> vulnerable to a memory leakage issue. It could occur while unplugging the
> device, and doing so repeatedly would result in leaking host memory affecting,
> other services on the host.
>
> A privileged user inside guest could use this flaw to cause a DoS on the host
> and/or potentially crash the Qemu process on the host.
>
> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg03024.html
> https://bugzilla.redhat.com/show_bug.cgi?id=1389538

> > Fix memory leak and simplify code for VMStateDescription

Use CVE-2016-9101.

This is not yet available at
http://git.qemu.org/?p=qemu.git;a=history;f=hw/net/eepro100.c but
that may be an expected place for a later update.

- -- 
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
  http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJYFktnAAoJEHb/MwWLVhi2lRUQAKvmWbVHDslM/pVcKhOXd48q
4VW+EZjJHnlkF39M1UFWsflRqFrVreNrXRVgTX7bGkV1QkbpyuWjCw3fHn02PCf4
9h19lPYSlxUt/P6kF8RVgQmC0FEv7fAB7nzftdmozHaL+G0MJCjdP0T+M9zBvEIg
nEPXrD+G7CWH8CR3LaDDNFl6O673QMyte9/garR8wOohsJnsxI4FBGdmJqmbrYnm
DbYw41H893s9F2t/ofW4ZyiwMDlJJG49DySb2yLHROFfd0y8n0qP0RviPl8p+EsL
hwOODU5ttVwIX3BQUkPNdumwxizTuIGY/m6lyibjj4SoyGNKiI3a05BwXI3mQhaA
cEbBu73o8rr7Yzp9J24n8WsbFdcGsTCWI2WYuG9g/qvEQuIlGFqMIdy/Z3GvpZuA
+h/IUZ+eDs5bc6vkDiCE88H3ZIi5ReSVCV9g4Bv/wfqwJ13qmLDooYeaWHjARY8h
Vse1XkGked1vz4uLYuB/X8N4uNytSnuDSUBTpvdXFaBZPSahqP12qQvOBnHxHT8l
wSTjpjcaVTsvXf5CqDgDYG6h8TcA8cGvvrn3XGP+UpsgvtqJcaccPF4N3awygFQu
fPcfl0dQU68NiuxPM7n0N+2qdPPkxu95ZqnobjeEMvaYRqQSJc6YJzkRMJXO2QCZ
Dt1YlBbsK4nRlp+7XF/D
=GdbU
-----END PGP SIGNATURE-----