The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Feb 20, 2019 | Jun 16, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Jun 16, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm | Dec 4, 2019 | Jun 16, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm | Apr 16, 2020 | Jun 16, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 11, 2016 |
| Suse | — | Upgrade xen-libsUpgrade qemu-langUpgrade qemu-ipxeUpgrade qemuUpgrade xen-tools-xendomains-wait-diskUpgrade qemu-ppcUpgrade xen-kmp-paeUpgrade qemu-seabiosUpgrade xen-develUpgrade qemu-x86Upgrade kvmUpgrade qemu-sgabiosUpgrade xen-doc-htmlUpgrade xenUpgrade xen-doc-pdfUpgrade qemu-s390Upgrade xen-libs-32bitUpgrade xen-kmp-defaultUpgrade qemu-kvmUpgrade xen-toolsUpgrade qemu-toolsUpgrade xen-tools-domUUpgrade qemu-vgabiosUpgrade qemu-block-rbdUpgrade qemu-block-curlUpgrade qemu-guest-agent | Mar 28, 2016 | Mar 24, 2016 |
| Ubuntu | — | Upgrade qemu-system-aarch64Upgrade qemu-system-mipsUpgrade qemu-system-s390xUpgrade qemu-system-ppcUpgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-miscUpgrade qemu-kvmUpgrade qemu-system-sparcUpgrade qemu-system-arm | May 12, 2016 | May 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub