CVE-2020-25650

A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path /run/spice-vdagentd/spice-vdagent-sock could use this flaw to perform a memory denial of service for spice-vdagentd or even other processes in the VM system. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and previous versions.

spice-vdagent is an optional component for enhancing user experience and performing guest-oriented management tasks. Its features includes: client mouse mode (no need to grab mouse by client, no mouse lag), automatic adjustment of screen resolution, copy and paste (text and image) between client and domU. It also requires vdagent service installed on domU o.s. to work. The default is 0.

Security Fix(es):

A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.(CVE-2020-25653)

A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX domain socket in /run/spice-vdagentd/spice-vdagent-sock. Any unprivileged local guest user could use this flaw to prevent legitimate agents from connecting to the spice-vdagentd daemon, resulting in a denial of service. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and prior.(CVE-2020-25652)

A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path /run/spice-vdagentd/spice-vdagent-sock could use this flaw to perform a memory denial of service for spice-vdagentd or even other processes in the VM system. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and previous versions.(CVE-2020-25650)

A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or in parts in the client connection of an illegitimate local user in the VM system. Active file transfers from other users could also be interrupted, resulting in a denial of service. The highest threat from this vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent versions 0.20 and prior.(CVE-2020-25651)

The spice-vdagent packages provide a SPICE agent for Linux guests.

Security Fix(es):

• spice-vdagent: possible file transfer DoS and information leak via active_xfers hash map (CVE-2020-25651)

• spice-vdagent: UNIX domain socket peer PID retrieved via SO_PEERCRED is subject to race condition (CVE-2020-25653)

• spice-vdagent: memory DoS via arbitrary entries in active_xfers hash table (CVE-2020-25650)

• spice-vdagent: possibility to exhaust file descriptors in vdagentd (CVE-2020-25652)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path /run/spice-vdagentd/spice-vdagent-sock could use this flaw to perform a memory denial of service for spice-vdagentd or even other processes in the VM system. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and previous versions.

The spice-vdagent packages provide a SPICE agent for Linux guests.

Security Fix(es):

• spice-vdagent: possible file transfer DoS and information leak via active_xfers hash map (CVE-2020-25651)

• spice-vdagent: UNIX domain socket peer PID retrieved via SO_PEERCRED is subject to race condition (CVE-2020-25653)

• spice-vdagent: memory DoS via arbitrary entries in active_xfers hash table (CVE-2020-25650)

• spice-vdagent: possibility to exhaust file descriptors in vdagentd (CVE-2020-25652)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Matthias Gerstner discovered that SPICE vdagent incorrectly handled the active_xfers hash table. A local attacker could possibly use this issue to cause SPICE vdagent to consume memory, resulting in a denial of service (CVE-2020-25650).

Matthias Gerstner discovered that SPICE vdagent incorrectly handled the active_xfers hash table. A local attacker could possibly use this issue to cause SPICE vdagent to consume memory, resulting in a denial of service, or obtain sensitive file contents (CVE-2020-25651).

Matthias Gerstner discovered that SPICE vdagent incorrectly handled a large number of client connections. A local attacker could possibly use this issue to cause SPICE vdagent to consume resources, resulting in a denial of service (CVE-2020-25652).

Matthias Gerstner discovered that SPICE vdagent incorrectly handled client connections. A local attacker could possibly use this issue to obtain sensitive information, paste clipboard contents, and transfer files into the active session (CVE-2020-25653).

This update for spice-vdagent fixes the following issues:

• Update to version 0.21.0
• CVE-2020-25650: memory DoS via arbitrary entries in active_xfers hash table (bsc#1177780)
• CVE-2020-25651: possible file transfer DoS and information leak via active_xfers hash map (bsc#1177781)
• CVE-2020-25652: possibility to exhaust file descriptors in vdagentd (bsc#1177782)
• CVE-2020-25653: UNIX domain socket peer PID retrieved via SO_PEERCRED is subject to race condition (bsc#1177783)

These are all security issues fixed in the spice-vdagent-0.21.0-1.7 package on the GA media of openSUSE Tumbleweed.

This update for spice-vdagent fixes the following issues:

Security issues fixed:

• CVE-2020-25650: Fixed a memory DoS via arbitrary entries in active_xfers hash table (bsc#1177780).
• CVE-2020-25651: Fixed a possible file transfer DoS and information leak via active_xfers hash map (bsc#1177781).
• CVE-2020-25652: Fixed a possibility to exhaust file descriptors in vdagentd (bsc#1177782).
• CVE-2020-25653: Fixed a race condition when the UNIX domain socket peer PID retrieved via SO_PEERCRED (bsc#1177783).

This update for spice-vdagent fixes the following issues:

• Update to version 0.21.0
• CVE-2020-25650: memory DoS via arbitrary entries in active_xfers hash table (bsc#1177780)
• CVE-2020-25651: possible file transfer DoS and information leak via active_xfers hash map (bsc#1177781)
• CVE-2020-25652: possibility to exhaust file descriptors in vdagentd (bsc#1177782)
• CVE-2020-25653: UNIX domain socket peer PID retrieved via SO_PEERCRED is subject to race condition (bsc#1177783)

This update for spice-vdagent fixes the following issues:

• CVE-2020-25650: memory DoS via arbitrary entries in active_xfers hash table (bsc#1177780)
• CVE-2020-25651: possible file transfer DoS and information leak via active_xfers hash map (bsc#1177781)
• CVE-2020-25652: possibility to exhaust file descriptors in vdagentd (bsc#1177782)
• CVE-2020-25653: UNIX domain socket peer PID retrieved via SO_PEERCRED is subject to race condition (bsc#1177783)

This update for spice-vdagent fixes the following issues:

• CVE-2020-25650: memory DoS via arbitrary entries in active_xfers hash table (bsc#1177780)
• CVE-2020-25651: possible file transfer DoS and information leak via active_xfers hash map (bsc#1177781)
• CVE-2020-25652: possibility to exhaust file descriptors in vdagentd (bsc#1177782)
• CVE-2020-25653: UNIX domain socket peer PID retrieved via SO_PEERCRED is subject to race condition (bsc#1177783)

Matthias Gerstner discovered that SPICE vdagent incorrectly handled the active_xfers hash table. A local attacker could possibly use this issue to cause SPICE vdagent to consume memory, resulting in a denial of service. (CVE-2020-25650)

Matthias Gerstner discovered that SPICE vdagent incorrectly handled the active_xfers hash table. A local attacker could possibly use this issue to cause SPICE vdagent to consume memory, resulting in a denial of service, or obtain sensitive file contents. (CVE-2020-25651)

Matthias Gerstner discovered that SPICE vdagent incorrectly handled a large number of client connections. A local attacker could possibly use this issue to cause SPICE vdagent to consume resources, resulting in a denial of service. (CVE-2020-25652)

Matthias Gerstner discovered that SPICE vdagent incorrectly handled client connections. A local attacker could possibly use this issue to obtain sensitive information, paste clipboard contents, and transfer files into the active session. (CVE-2020-25653)