The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | debian-upgrade-qemudebian-upgrade-qemu-kvm | Mar 31, 2017 | Oct 5, 2016 | |
| Gentoo Linux | gentoo-linux-upgrade-app-emulation-qemu | Oct 30, 2017 | Oct 5, 2016 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-qemu-imghuawei-euleros-2_0_sp2-upgrade-qemu-kvmhuawei-euleros-2_0_sp2-upgrade-qemu-kvm-common | Dec 4, 2019 | Oct 5, 2016 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-qemu-imghuawei-euleros-2_0_sp3-upgrade-qemu-kvmhuawei-euleros-2_0_sp3-upgrade-qemu-kvm-common | Apr 16, 2020 | Oct 5, 2016 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-qemu-imghuawei-euleros-2_0_sp5-upgrade-qemu-kvmhuawei-euleros-2_0_sp5-upgrade-qemu-kvm-common | Nov 19, 2019 | Oct 5, 2016 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Sep 21, 2016 |
| Suse | — | suse-upgrade-kvmsuse-upgrade-qemususe-upgrade-qemu-armsuse-upgrade-qemu-audio-alsasuse-upgrade-qemu-audio-osssuse-upgrade-qemu-audio-pasuse-upgrade-qemu-audio-spicesuse-upgrade-qemu-block-curlsuse-upgrade-qemu-block-iscsisuse-upgrade-qemu-block-rbdsuse-upgrade-qemu-block-sshsuse-upgrade-qemu-chardev-baumsuse-upgrade-qemu-chardev-spicesuse-upgrade-qemu-guest-agentsuse-upgrade-qemu-hw-display-qxlsuse-upgrade-qemu-hw-display-virtio-gpususe-upgrade-qemu-hw-display-virtio-gpu-pcisuse-upgrade-qemu-hw-display-virtio-vgasuse-upgrade-qemu-hw-s390x-virtio-gpu-ccwsuse-upgrade-qemu-hw-usb-redirectsuse-upgrade-qemu-ipxesuse-upgrade-qemu-ksmsuse-upgrade-qemu-kvmsuse-upgrade-qemu-langsuse-upgrade-qemu-microvmsuse-upgrade-qemu-ppcsuse-upgrade-qemu-s390suse-upgrade-qemu-s390xsuse-upgrade-qemu-seabiossuse-upgrade-qemu-sgabiossuse-upgrade-qemu-skibootsuse-upgrade-qemu-toolssuse-upgrade-qemu-ui-cursessuse-upgrade-qemu-ui-gtksuse-upgrade-qemu-ui-openglsuse-upgrade-qemu-ui-spice-appsuse-upgrade-qemu-ui-spice-coresuse-upgrade-qemu-vgabiossuse-upgrade-qemu-x86suse-upgrade-xensuse-upgrade-xen-develsuse-upgrade-xen-doc-htmlsuse-upgrade-xen-doc-pdfsuse-upgrade-xen-kmp-defaultsuse-upgrade-xen-kmp-paesuse-upgrade-xen-kmp-tracesuse-upgrade-xen-libssuse-upgrade-xen-libs-32bitsuse-upgrade-xen-toolssuse-upgrade-xen-tools-domususe-upgrade-xen-tools-xendomains-wait-disk | Nov 23, 2016 | Oct 5, 2016 |
| Ubuntu | ubuntu-upgrade-qemu-kvmubuntu-upgrade-qemu-systemubuntu-upgrade-qemu-system-aarch64ubuntu-upgrade-qemu-system-armubuntu-upgrade-qemu-system-mipsubuntu-upgrade-qemu-system-miscubuntu-upgrade-qemu-system-ppcubuntu-upgrade-qemu-system-s390xubuntu-upgrade-qemu-system-sparcubuntu-upgrade-qemu-system-x86 | Nov 9, 2016 | Oct 5, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub