Description
QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.openwall.com/lists/oss-security/2016/03/07/4 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=1314676 ↗
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=60253ed1e6ec6d8e5ef2efe7bf755f475dce9956 ↗
- https://security.gentoo.org/glsa/201604-01 ↗
- http://www.securityfocus.com/bid/84134 ↗
- http://www.ubuntu.com/usn/USN-2974-1 ↗
- http://www.openwall.com/lists/oss-security/2016/03/04/1 ↗
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html ↗