Cloudanix VulnDB

CVE-2015-5260

High · 7.8

CVSS

7.8

EPSS

0.6%

Published

Jun 7, 2016

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the software that connects virtual machines to their display hardware can let a program inside one virtual machine crash or take over the computer running all the virtual machines.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Heap-based buffer overflow in SPICE via malicious QXL commands with crafted surface_id values, resulting in heap memory corruption that can lead to QEMU-KVM process crash or arbitrary code execution on the host.

Why it matters to the business

Enables guest-to-host escape that can crash critical virtualized workloads or allow full host compromise, leading to widespread service disruption, data exposure, and loss of isolation between tenants.

How an attack unfolds

An attacker controlling a guest VM crafts QXL commands containing an out-of-bounds surface_id, sends them over the SPICE channel, and triggers the vulnerable buffer handling path in the host SPICE server before version 0.12.6, causing heap corruption that is leveraged for denial of service or code execution.

How to fix it

Upgrade SPICE to version 0.12.6 or later on all affected Red Hat Enterprise Linux, Debian, and Ubuntu systems; apply vendor-supplied patches for QEMU-KVM and SPICE packages.

How to confirm the fix worked

Confirm SPICE package version is at least 0.12.6, review QEMU logs for absence of surface_id-related crashes, and perform regression testing of QXL display functionality after upgrade.

Typical attack path

  1. Obtain code execution or control inside a guest VM
  2. Craft and transmit malicious QXL surface commands via SPICE protocol
  3. Trigger heap overflow and memory corruption in host SPICE/QEMU process
  4. Escalate to arbitrary code execution or crash the hypervisor host

How to detect it

Review QEMU and SPICE logs for repeated surface_id errors or heap corruption indicators, correlate with guest VM activity spikes, and search for sudden QEMU process terminations on hosts running older SPICE versions.

What your security team should do

  • Prioritize immediate upgrade of SPICE on all virtualization hosts given the guest-to-host attack surface
  • Temporarily disable SPICE/QXL where feasible until patches are applied
  • Monitor QEMU process stability and SPICE channel activity for anomalous behavior

The record

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands related to the surface_id parameter.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 spice 0 0.12.5-1.3
Debian:12 spice 0 0.12.5-1.3
Debian:13 spice 0 0.12.5-1.3
Debian:7 spice 0 0.11.0-1+deb7u2
Debian:8 spice 0 0.12.5-1+deb8u2
Mageia:5 spice 0 0.12.5-2.2.mga5
Red Hat:enterprise_linux:6::client spice-server 0 0:0.12.4-12.el6_7.3
Red Hat:enterprise_linux:6::client spice-server-debuginfo 0 0:0.12.4-12.el6_7.3
Red Hat:enterprise_linux:6::client spice-server-devel 0 0:0.12.4-12.el6_7.3
Red Hat:enterprise_linux:6::computenode spice-server 0 0:0.12.4-12.el6_7.3
Red Hat:enterprise_linux:6::computenode spice-server-debuginfo 0 0:0.12.4-12.el6_7.3
Red Hat:enterprise_linux:6::computenode spice-server-devel 0 0:0.12.4-12.el6_7.3
Red Hat:enterprise_linux:6::server spice-server 0 0:0.12.4-12.el6_7.3
Red Hat:enterprise_linux:6::server spice-server-debuginfo 0 0:0.12.4-12.el6_7.3
Red Hat:enterprise_linux:6::server spice-server-devel 0 0:0.12.4-12.el6_7.3
Red Hat:enterprise_linux:6::workstation spice-server 0 0:0.12.4-12.el6_7.3
Red Hat:enterprise_linux:6::workstation spice-server-debuginfo 0 0:0.12.4-12.el6_7.3
Red Hat:enterprise_linux:6::workstation spice-server-devel 0 0:0.12.4-12.el6_7.3
Red Hat:enterprise_linux:7::client spice 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::client spice-debuginfo 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::client spice-server 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::client spice-server-devel 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::computenode spice 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::computenode spice-debuginfo 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::computenode spice-server 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::computenode spice-server-devel 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::server spice 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::server spice-debuginfo 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::server spice-server 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::server spice-server-devel 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::workstation spice 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::workstation spice-debuginfo 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::workstation spice-server 0 0:0.12.4-9.el7_1.3
Red Hat:enterprise_linux:7::workstation spice-server-devel 0 0:0.12.4-9.el7_1.3
SUSE:Linux Enterprise Desktop 12 spice 0 0.12.4-8.5.1
SUSE:Linux Enterprise Desktop 12 SP1 spice 0 0.12.5-4.1
SUSE:Linux Enterprise Server 11 SP4 spice 0 0.12.4-5.1
SUSE:Linux Enterprise Server 12 spice 0 0.12.4-8.5.1
SUSE:Linux Enterprise Server 12 SP1 spice 0 0.12.5-4.1
SUSE:Linux Enterprise Server for SAP Applications 11 SP4 spice 0 0.12.4-5.1
SUSE:Linux Enterprise Server for SAP Applications 12 spice 0 0.12.4-8.5.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP1 spice 0 0.12.5-4.1
SUSE:Linux Enterprise Software Development Kit 11 SP4 spice 0 0.12.4-5.1
SUSE:Linux Enterprise Software Development Kit 12 spice 0 0.12.4-8.5.1
SUSE:Linux Enterprise Software Development Kit 12 SP1 spice 0 0.12.5-4.1
Ubuntu:14.04:LTS spice 0 0.12.4-0nocelt2ubuntu1.2
Ubuntu:16.04:LTS spice 0 0.12.5-1.1ubuntu2
openSUSE:Tumbleweed spice 0 0.12.8-2.1

Related vulnerabilities