QEMU CVE-2019-12155 Local Denial of Service Vulnerability

Bugtraq ID:	108429
Class:	Input Validation Error
CVE:	CVE-2019-12155
Remote:	No
Local:	Yes
Published:	May 22 2019 12:00AM
Updated:	May 22 2019 12:00AM
Credit:	Sergej Schumilo, Cornelius Aschermann and Simon Wrner of Ruhr University Bochum.
Vulnerable:	Redhat OpenStack Platform 9.0 Redhat OpenStack Platform 14.0 (Rocky) Redhat OpenStack Platform 13.0 (Queens) Redhat OpenStack Platform 10 Redhat Enterprise Linux 8 Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Redhat Enterprise Linux 5 QEMU QEMU 0
Not Vulnerable:

QEMU CVE-2019-12155 Local Denial of Service Vulnerability

QEMU is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to crash the QEMU process, resulting in a denial-of-service condition.

QEMU CVE-2019-12155 Local Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

QEMU CVE-2019-12155 Local Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

QEMU CVE-2019-12155 Local Denial of Service Vulnerability

References:

• QEMU Homepage (QEMU)
  
• qxl: check release info object (Qemu)
  
• Bug 1712670 (CVE-2019-12155) - CVE-2019-12155 QEMU: qxl: null pointer dereferen (Redhat)
  
• CVE-2019-12155 QEMU: qxl: null pointer dereference while releasing spice resour (Seclists.org)
  
• CVE-2019-12155 (Redhat)