The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Feb 20, 2019 | Jun 16, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Jun 16, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Dec 4, 2019 | Jun 16, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-img | Apr 16, 2020 | Jun 16, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 11, 2016 |
| Suse | — | Upgrade xen-libsUpgrade xen-develUpgrade xen-tools-xendomains-wait-diskUpgrade qemuUpgrade qemu-langUpgrade qemu-seabiosUpgrade xen-kmp-paeUpgrade qemu-ppcUpgrade qemu-ipxeUpgrade qemu-toolsUpgrade qemu-kvmUpgrade kvmUpgrade xen-libs-32bitUpgrade qemu-s390Upgrade xen-doc-pdfUpgrade xenUpgrade qemu-x86Upgrade qemu-guest-agentUpgrade qemu-sgabiosUpgrade xen-kmp-defaultUpgrade xen-toolsUpgrade xen-tools-domUUpgrade xen-doc-htmlUpgrade qemu-block-curlUpgrade qemu-vgabiosUpgrade qemu-block-rbd | Mar 28, 2016 | Mar 24, 2016 |
| Ubuntu | — | Upgrade qemu-system-aarch64Upgrade qemu-system-s390xUpgrade qemu-system-ppcUpgrade qemu-system-mipsUpgrade qemu-system-miscUpgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-kvmUpgrade qemu-system-armUpgrade qemu-system-sparc | May 12, 2016 | May 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub