Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Sep 20, 2017 | Apr 18, 2014 |
| Centos_linux | — | Upgrade qemu-imgUpgrade qemu-kvm-toolsUpgrade qemu-kvmUpgrade qemu-guest-agent | Dec 1, 2016 | Apr 18, 2014 |
| Debian | — | Upgrade qemu-kvmUpgrade qemu | Jul 30, 2024 | Apr 18, 2014 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Apr 18, 2014 |
| Oracle_linux | — | Upgrade qemu-kvmUpgrade qemu-kvm-toolsUpgrade qemu-imgUpgrade qemu-guest-agent | Oct 16, 2024 | Apr 18, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 11, 2014 |
| Suse | — | Upgrade qemu-x86Upgrade qemu-vgabiosUpgrade qemu-block-rbdUpgrade qemu-toolsUpgrade qemu-block-sshUpgrade kvmUpgrade qemu-sgabiosUpgrade qemu-langUpgrade qemu-armUpgrade qemu-ipxeUpgrade qemu-ppcUpgrade qemu-guest-agentUpgrade qemuUpgrade qemu-ksmUpgrade qemu-block-curlUpgrade qemu-block-iscsiUpgrade qemu-kvmUpgrade qemu-s390Upgrade qemu-seabios | Dec 18, 2015 | Apr 18, 2014 |
| Ubuntu | — | Upgrade qemu-system-ppcUpgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-armUpgrade qemu-system-x86Upgrade qemu-system-miscUpgrade qemu-kvmUpgrade qemu-system-aarch64Upgrade qemu-system-sparc | Nov 8, 2024 | Apr 18, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub