[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] input: limit kbd queue depth

From: Gerd Hoffmann
Subject: Re: [Qemu-devel] [PATCH] input: limit kbd queue depth
Date: Fri, 28 Apr 2017 11:05:09 +0200

On Fr, 2017-04-28 at 09:49 +0100, Daniel P. Berrange wrote:
> On Fri, Apr 28, 2017 at 10:42:37AM +0200, Gerd Hoffmann wrote:
> > Apply a limit to the number of items we accept into the keyboard queue.
> Is there a need for similar protection fir mouse input events from VNC ?

No, there is no delay queue for mouse events.

> > Impact: Without this limit vnc clients can exhaust host memory by
> > sending keyboard events faster than qemu feeds them to the guest.
> Ability for a remote network client to crash a host by exhausting
> memory should be considered a security flaw & have a CVE allocated
> for it.

Sure, it's WIP, Prasit will get one.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]