CVE-2016-2150

SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261.

Updated spice packages fix security vulnerabilities:

A memory allocation flaw, leading to a heap-based buffer overflow, was found in spice's smartcard interaction, which runs under the QEMU-KVM context on the host. A user connecting to a guest VM using spice could potentially use this flaw to crash the QEMU-KVM process or execute arbitrary code with the privileges of the host's QEMU-KVM process (CVE-2016-0749).

A memory access flaw was found in the way spice handled certain guests using crafted primary surface parameters. A user in a guest could use this flaw to read from and write to arbitrary memory locations on the host (CVE-2016-2150).

These are all security issues fixed in the libspice-server-devel-0.12.8-2.1 package on the GA media of openSUSE Tumbleweed.

spice was updated to fix four security issues.

These security issues were fixed:

• CVE-2016-2150: Guest escape using crafted primary surface parameters (bsc#982386).
• CVE-2016-0749: Heap-based buffer overflow in smartcard interaction (bsc#982385).
• CVE-2015-5260: Insufficient validation of surface_id parameter could have caused a crash (bsc#944787).
• CVE-2015-5261: Host memory access from guest using crafted images (bsc#948976).

spice was updated to fix two security issues.

These security issues were fixed:

• CVE-2016-2150: Guest escape using crafted primary surface parameters (bsc#982386).
• CVE-2016-0749: Heap-based buffer overflow in smartcard interaction (bsc#982385).

This update for spice fixes the following issues:

• CVE-2021-20201: client initiated renegotiation causing denial of service (bsc#1181686)
• CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code (bsc#1177158)
• CVE-2016-2150: Fixed a guest escape using crafted primary surface parameters (bsc#982386)

Jing Zhao discovered that the Spice smartcard support incorrectly handled memory. A remote attacker could use this issue to cause Spice to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2016-0749)

Frediano Ziglio discovered that Spice incorrectly handled certain primary surface parameters. A malicious guest operating system could potentially exploit this issue to escape virtualization. (CVE-2016-2150)