From: "Daniel P. Berrange" <berrange@redhat.com>
To: qemu-devel@nongnu.org
Cc: Gerd Hoffmann <kraxel@redhat.com>
Subject: [Qemu-devel] [PATCH 0/2] CVE-2015-1779: fix denial of service in VNC websockets
Date: Mon, 23 Mar 2015 22:58:20 +0000 [thread overview]
Message-ID: <1427151502-14386-1-git-send-email-berrange@redhat.com> (raw)
The VNC websockets protocol decoder has two places where it did
not correctly limit its resource usage when processing data from
the client. This can be abused by a malicious client to cause QEMU
to consume all system memory, unless it is otherwise limited by
ulimits and/or cgroups. These problems can be triggered in the
websockets layer before the VNC protocol actually starts, so no
client authentication will have taken place at this point.
Daniel P. Berrange (2):
CVE-2015-1779: incrementally decode websocket frames
CVE-2015-1779: limit size of HTTP headers from websockets clients
ui/vnc-ws.c | 115 +++++++++++++++++++++++++++++++++++++++++-------------------
ui/vnc-ws.h | 9 +++--
ui/vnc.h | 2 ++
3 files changed, 88 insertions(+), 38 deletions(-)
--
2.1.0
next reply other threads:[~2015-03-23 22:58 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-03-23 22:58 Daniel P. Berrange [this message]
2015-03-23 22:58 ` [Qemu-devel] [PATCH 1/2] CVE-2015-1779: incrementally decode websocket frames Daniel P. Berrange
2015-03-31 17:42 ` Peter Maydell
2015-04-01 13:36 ` Gerd Hoffmann
2015-04-01 13:41 ` Peter Maydell
2015-04-09 14:12 ` Daniel P. Berrange
2015-03-31 18:01 ` Peter Maydell
2015-03-23 22:58 ` [Qemu-devel] [PATCH 2/2] CVE-2015-1779: limit size of HTTP headers from websockets clients Daniel P. Berrange
2015-03-24 15:51 ` [Qemu-devel] [PATCH 0/2] CVE-2015-1779: fix denial of service in VNC websockets Gerd Hoffmann
2015-03-31 9:17 ` Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1427151502-14386-1-git-send-email-berrange@redhat.com \
--to=berrange@redhat.com \
--cc=kraxel@redhat.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.