Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Feb 20, 2019 | Jun 16, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Jun 16, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-img | Dec 4, 2019 | Jun 16, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-kvm-commonUpgrade qemu-kvmUpgrade qemu-img | Apr 16, 2020 | Jun 16, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-common | Nov 19, 2019 | Jun 16, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 5, 2016 |
| Suse | — | Upgrade qemuUpgrade qemu-kvmUpgrade qemu-guest-agentUpgrade xen-tools-domuUpgrade qemu-toolsUpgrade qemu-ppcUpgrade xen-doc-pdfUpgrade qemu-block-rbdUpgrade xen-libs-32bitUpgrade xen-toolsUpgrade xen-libsUpgrade qemu-langUpgrade kvmUpgrade xen-develUpgrade qemu-ipxeUpgrade qemu-sgabiosUpgrade xen-tools-xendomains-wait-diskUpgrade qemu-block-curlUpgrade xen-kmp-defaultUpgrade qemu-seabiosUpgrade qemu-s390Upgrade xen-doc-htmlUpgrade xen-kmp-paeUpgrade qemu-x86Upgrade xenUpgrade qemu-vgabios | Mar 28, 2016 | Mar 24, 2016 |
| Ubuntu | — | Upgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-armUpgrade qemu-system-miscUpgrade qemu-system-s390xUpgrade qemu-kvmUpgrade qemu-system-mipsUpgrade qemu-system-ppcUpgrade qemu-system-aarch64Upgrade qemu-system-sparc | May 12, 2016 | May 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub