CVE-2015-1779: fix denial of service in VNC websockets
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest2 patches 7 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | CVE-2015-1779: incrementally decode websocket framesui/ ui/ ui/ | +80 | 5 replies | |
| 2/2 | CVE-2015-1779: limit size of HTTP headers from websockets clientsui/ | +8 | 0 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [Qemu-devel] [PATCH 0/2] CVE-2015-1779: fix denial of service in VNC websockets
The VNC websockets protocol decoder has two places where it did not correctly limit its resource usage when processing data from the client. This can be abused by a malicious client to cause QEMU to consume all system memory, unless it is otherwise limited by ulimits and/or cgroups. These problems can be triggered in the websockets layer before the VNC protocol actually starts, so no client authentication will have taken place at this point.
Daniel P. Berrange (2):
CVE-2015-1779: incrementally decode websocket frames
CVE-2015-1779: limit size of HTTP headers from websockets clients
ui/vnc-ws.c | 115 +++++++++++++++++++++++++++++++++++++++++------------------- ui/vnc-ws.h | 9 +++-- ui/vnc.h | 2 ++ 3 files changed, 88 insertions(+), 38 deletions(-)
Signature · 1 line
2.1.0