QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Feb 9, 2016 | Feb 8, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 29, 2016 |
| Suse | — | Upgrade qemu-s390xUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-ipxeUpgrade qemu-chardev-spiceUpgrade qemu-langUpgrade qemu-block-rbdUpgrade qemu-ui-openglUpgrade xen-libsUpgrade xen-develUpgrade qemu-hw-display-virtio-gpuUpgrade xen-kmp-defaultUpgrade qemu-ui-spice-appUpgrade qemu-audio-spiceUpgrade qemuUpgrade xen-doc-htmlUpgrade xen-libs-32bitUpgrade qemu-audio-ossUpgrade xen-toolsUpgrade qemu-hw-display-qxlUpgrade qemu-toolsUpgrade qemu-skibootUpgrade qemu-hw-display-virtio-vgaUpgrade xen-tools-xendomains-wait-diskUpgrade qemu-block-sshUpgrade qemu-armUpgrade qemu-kvmUpgrade qemu-ui-gtkUpgrade qemu-ppcUpgrade qemu-chardev-baumUpgrade qemu-microvmUpgrade qemu-block-iscsiUpgrade qemu-s390Upgrade qemu-x86Upgrade qemu-block-curlUpgrade qemu-guest-agentUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-audio-paUpgrade xen-tools-domUUpgrade qemu-ui-cursesUpgrade qemu-sgabiosUpgrade qemu-ui-spice-coreUpgrade qemu-hw-usb-redirectUpgrade xen-kmp-paeUpgrade qemu-seabiosUpgrade qemu-audio-alsaUpgrade xenUpgrade qemu-vgabiosUpgrade qemu-ksm | Mar 28, 2016 | Mar 24, 2016 |
| Ubuntu | — | Upgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-x86Upgrade qemu-system-armUpgrade qemu-system-sparcUpgrade qemu-system-aarch64Upgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-kvm | Feb 3, 2016 | Feb 3, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub