CVE-2016-0749

The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.

Updated spice packages fix security vulnerabilities:

A memory allocation flaw, leading to a heap-based buffer overflow, was found in spice's smartcard interaction, which runs under the QEMU-KVM context on the host. A user connecting to a guest VM using spice could potentially use this flaw to crash the QEMU-KVM process or execute arbitrary code with the privileges of the host's QEMU-KVM process (CVE-2016-0749).

A memory access flaw was found in the way spice handled certain guests using crafted primary surface parameters. A user in a guest could use this flaw to read from and write to arbitrary memory locations on the host (CVE-2016-2150).

These are all security issues fixed in the libspice-server-devel-0.12.8-2.1 package on the GA media of openSUSE Tumbleweed.

spice was updated to fix four security issues.

These security issues were fixed:

• CVE-2016-2150: Guest escape using crafted primary surface parameters (bsc#982386).
• CVE-2016-0749: Heap-based buffer overflow in smartcard interaction (bsc#982385).
• CVE-2015-5260: Insufficient validation of surface_id parameter could have caused a crash (bsc#944787).
• CVE-2015-5261: Host memory access from guest using crafted images (bsc#948976).

spice was updated to fix two security issues.

These security issues were fixed:

• CVE-2016-2150: Guest escape using crafted primary surface parameters (bsc#982386).
• CVE-2016-0749: Heap-based buffer overflow in smartcard interaction (bsc#982385).

Jing Zhao discovered that the Spice smartcard support incorrectly handled memory. A remote attacker could use this issue to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-0749)

Frediano Ziglio discovered that Spice incorrectly handled certain primary surface parameters. A malicious guest operating system could potentially exploit this issue to escape virtualization. (CVE-2016-2150)