The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu-kvmUpgrade qemu | Mar 31, 2017 | Oct 5, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Oct 5, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Dec 4, 2019 | Oct 5, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Apr 16, 2020 | Oct 5, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-common | Nov 19, 2019 | Oct 5, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 21, 2016 |
| Suse | — | Upgrade qemu-ppcUpgrade qemu-hw-display-virtio-vgaUpgrade xen-tools-xendomains-wait-diskUpgrade qemu-langUpgrade qemu-ui-gtkUpgrade qemu-toolsUpgrade qemu-ui-openglUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-ui-spice-coreUpgrade qemu-microvmUpgrade qemu-ui-spice-appUpgrade kvmUpgrade qemu-audio-ossUpgrade qemu-vgabiosUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-armUpgrade qemu-audio-paUpgrade qemu-block-rbdUpgrade qemu-hw-usb-redirectUpgrade qemu-sgabiosUpgrade qemu-block-iscsiUpgrade xen-develUpgrade qemu-chardev-spiceUpgrade qemu-block-sshUpgrade qemu-s390xUpgrade qemu-guest-agentUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-hw-display-qxlUpgrade xen-toolsUpgrade qemuUpgrade qemu-ipxeUpgrade xen-doc-pdfUpgrade xen-doc-htmlUpgrade qemu-ui-cursesUpgrade qemu-skibootUpgrade qemu-ksmUpgrade qemu-audio-spiceUpgrade xen-libs-32bitUpgrade xen-kmp-traceUpgrade qemu-chardev-baumUpgrade xen-libsUpgrade qemu-x86Upgrade xen-kmp-paeUpgrade qemu-kvmUpgrade xen-kmp-defaultUpgrade xenUpgrade qemu-block-curlUpgrade xen-tools-domUUpgrade qemu-seabiosUpgrade qemu-s390Upgrade qemu-audio-alsa | Nov 23, 2016 | Oct 5, 2016 |
| Ubuntu | — | Upgrade qemu-systemUpgrade qemu-kvmUpgrade qemu-system-s390xUpgrade qemu-system-armUpgrade qemu-system-mipsUpgrade qemu-system-sparcUpgrade qemu-system-aarch64Upgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-system-x86 | Nov 9, 2016 | Oct 5, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub