CVE-2015-3247

What it actually does

Race condition in worker_update_monitors_config enables heap-based memory corruption from an authenticated guest, allowing denial of service via QEMU-KVM crash or potential arbitrary code execution on the host.

Why it matters to the business

Successful exploitation can crash the hypervisor, causing downtime for all hosted virtual machines and creating a path for attackers to gain control of the underlying host system.

How an attack unfolds

An attacker with guest access repeatedly triggers monitor configuration updates to win the race condition, corrupting heap memory and either crashing the QEMU process or leveraging the corruption to execute code outside the guest boundary.

How to fix it

Upgrade SPICE to a version containing the fix for the race condition in worker_update_monitors_config and apply corresponding updates to affected Red Hat Enterprise Linux packages.

How to confirm the fix worked

Verify the installed SPICE version is newer than 0.12.4, confirm the worker_update_monitors_config function contains synchronization fixes, and test that monitor reconfiguration no longer produces crashes under concurrent load.

Typical attack path

1. Obtain authenticated access inside a guest VM using SPICE
2. Repeatedly invoke monitor configuration updates to exploit the race
3. Trigger heap corruption leading to QEMU-KVM crash or code execution on host

How to detect it

Inspect QEMU and SPICE logs for repeated monitor configuration calls followed by heap corruption errors or abrupt process termination; correlate guest authentication events with subsequent host-level crashes.

What your security team should do

• Prioritize patching SPICE on all hypervisor hosts due to potential host compromise
• Restrict SPICE access to trusted guests only and monitor for unusual monitor configuration activity
• Review hypervisor logs for unexplained QEMU crashes and schedule upgrades during the next maintenance window