{"id":37426,"date":"2019-10-31T22:17:33","date_gmt":"2019-10-31T19:17:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu\/"},"modified":"2019-10-31T22:17:33","modified_gmt":"2019-10-31T19:17:33","slug":"uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu","title":{"rendered":"A vulnerability allowing to escape the isolated QEMU environment.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Revealed<\/a><\/noindex> Details of the critical vulnerability (CVE-2019-14378<\/a><\/noindex>) in the SLIRP handler, which is by default used in QEMU to establish a communication channel between the virtual network adapter in the guest system and the network backend on the QEMU side. The issue also affects virtualization systems based on KVM (in the Usermode<\/a><\/noindex>) and VirtualBox, which use the slirp backend from QEMU, as well as applications that utilize the user space network stack libSLIRP<\/a><\/noindex> (TCP\/IP emulator).<\/p>\n

The vulnerability allows for code execution on the host system with the permissions of the QEMU process handler when a specially crafted very large network packet is sent from the guest system, which requires fragmentation. Due to an error in the ip_reass() function invoked during the reassembly of incoming packets, the first fragment may not fit in the allocated buffer, and its tail will be written to the memory areas following the buffer. <\/p>\n

To test an already is available<\/a><\/noindex> A working exploit prototype has been developed that includes bypassing ASLR and executing code via overwriting the memory of the main_loop_tlg array, which includes the QEMUTimerList with handlers triggered by timer events.
\nThe vulnerability has already been fixed in Alpine<\/a><\/noindex> and Arch<\/a><\/noindex>, but remains unresolved in Debian<\/a><\/noindex>, Arch Linux<\/a><\/noindex> and FreeBSD<\/a><\/noindex>. In Ubuntu<\/a><\/noindex> and SUSE\/openSUSE<\/a><\/noindex> The issue does not manifest due to the lack of slirp usage. The vulnerability remains unpatched in the latest release of libslirp 4.0<\/a><\/noindex> (the fix is currently available as a patch<\/a><\/noindex>).<\/p>\n

<\/a><\/noindex><\/p>\n

Source: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-14378) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 SLIRP, \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 QEMU \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u0430\u043d\u0430\u043b\u0430 \u0441\u0432\u044f\u0437\u0438 \u043c\u0435\u0436\u0434\u0443 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0430\u0434\u0430\u043f\u0442\u0435\u0440\u043e\u043c \u0432 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0431\u044d\u043a\u0435\u043d\u0434\u043e\u043c \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 QEMU. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 KVM (\u0432 \u0440\u0435\u0436\u0438\u043c\u0435 Usermode) \u0438 Virtualbox, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0431\u044d\u043a\u0435\u043d\u0434 slirp \u0438\u0437 QEMU, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37426","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 A vulnerability that allows escaping the isolated environment of QEMU | ProHoster","description":"Details of the critical vulnerability (","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f QEMU | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:17:33+00:00","article:modified_time":"2019-10-31T19:17:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37426","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 17:46:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:27:24","updated":"2026-01-23 17:46:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/37426","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=37426"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/37426\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=37426"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=37426"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=37426"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}