Pierluigi Paganini August 27, 2019

The open-source emulator QEMU is affected by a flaw that could be exploited to trigger a (DoS) condition or gain arbitrary code execution.

QEMU (short for Quick Emulator) is a free and open-source emulator that performs hardware virtualization. It emulates the machine’s processor through dynamic binary translation and provides a set of different hardware and device models for the machine, enabling it to run a variety of guest operating systems.

QEMU is affected by a vulnerability, tracked as CVE-2019-14378, that could be exploited by attackers to trigger a DoS condition or to gain arbitrary code execution. QEMU is available for several major Linux distributions and it is used by VirtualBox, and Xen.

The flaw was discovered by the researcher Vishnu Dev, who published technical details of the vulnerability after it was addressed.

“CVE-2019-14378, which is a pointer miscalculation in network backend of QEMU. The bug is triggered when large IPv4 fragmented packets are reassembled for processing. It was found by code auditing.” wrote the expert.

The vulnerability is a heap-based buffer overflow that can lead to a virtual machine (VM) escape, it affects the packet reassembly in SLiRP. Slirp is a program that emulates a PPP, SLIP, or CSLIP connection to the Internet via a shell account.

The vulnerability resides in the ip_reass() routine while reassembling incoming packets, in particular, the flaw is triggered if the first fragment is bigger than the m->m_dat[] buffer.

“A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the ip_reass() routine while reassembling incoming packets if the first fragment is bigger than the m->m_dat[] buffer.” reads the security advisory published by RedHat. “An attacker could use this flaw to crash the QEMU process on the host, resulting in a Denial of Service or potentially executing arbitrary code with privileges of the QEMU process. “

The good news is that the impact of the CVE-2019-14378 flaw is limited because production VMs typically do not use Slirp. Below some points highlighted by QEMU developer Stefan Hajnoczi.

“QEMU developer here. Some context on the impact and the security architecture of QEMU:

• 1. Production VMs almost exclusively use tap networking, not slirp. This CVE mostly affects users running QEMU manually for development and test VMs.
• 2. Slirp (https://gitlab.freedesktop.org/slirp/libslirp) is part of the QEMU userspace process, which runs unprivileged and confined by SELinux when launched via libvirt. To be clear: this is not a host ring-0 exploit!
• 3. Getting root on the host or accessing other VMs requires further exploits to elevate privileges of the QEMU process and escape SELinux confinement.

Pierluigi Paganini

(SecurityAffairs – QEMU, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]