Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Sep 20, 2017 | Apr 18, 2014 |
| Centos_linux | — | Upgrade qemu-imgUpgrade qemu-kvm-toolsUpgrade qemu-kvmUpgrade qemu-guest-agent | Dec 1, 2016 | Apr 18, 2014 |
| Debian | — | Upgrade qemuUpgrade qemu-kvm | Jul 30, 2024 | Apr 18, 2014 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Apr 18, 2014 |
| Oracle_linux | — | Upgrade qemu-kvm-toolsUpgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-guest-agent | Oct 16, 2024 | Apr 18, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 11, 2014 |
| Suse | — | Upgrade qemu-block-curlUpgrade qemu-kvmUpgrade qemu-ksmUpgrade qemu-seabiosUpgrade qemu-block-iscsiUpgrade qemu-s390Upgrade qemu-langUpgrade qemu-sgabiosUpgrade qemuUpgrade qemu-block-rbdUpgrade qemu-vgabiosUpgrade qemu-block-sshUpgrade qemu-guest-agentUpgrade kvmUpgrade qemu-toolsUpgrade qemu-ipxeUpgrade qemu-armUpgrade qemu-x86Upgrade qemu-ppc | Dec 18, 2015 | Apr 18, 2014 |
| Ubuntu | — | Upgrade qemu-system-ppcUpgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-armUpgrade qemu-system-sparcUpgrade qemu-kvmUpgrade qemu-system-aarch64Upgrade qemu-system-miscUpgrade qemu-system-x86 | Nov 8, 2024 | Apr 18, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub