The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemuUpgrade qemu-kvm | Mar 31, 2017 | Oct 5, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Oct 5, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Dec 4, 2019 | Oct 5, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm | Apr 16, 2020 | Oct 5, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-img | Nov 19, 2019 | Oct 5, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 21, 2016 |
| Suse | — | Upgrade xen-kmp-traceUpgrade qemu-s390Upgrade qemu-x86Upgrade qemu-skibootUpgrade xen-libsUpgrade qemu-ui-cursesUpgrade xen-doc-htmlUpgrade qemu-audio-spiceUpgrade qemu-block-curlUpgrade qemu-chardev-baumUpgrade xen-kmp-defaultUpgrade qemu-seabiosUpgrade qemu-kvmUpgrade xenUpgrade qemu-ksmUpgrade qemu-ipxeUpgrade xen-doc-pdfUpgrade xen-libs-32bitUpgrade qemu-audio-alsaUpgrade xen-kmp-paeUpgrade qemu-ui-spice-coreUpgrade qemu-s390xUpgrade xen-tools-domuUpgrade qemu-ui-gtkUpgrade qemu-vgabiosUpgrade qemuUpgrade qemu-sgabiosUpgrade qemu-guest-agentUpgrade qemu-hw-display-virtio-gpuUpgrade xen-tools-xendomains-wait-diskUpgrade qemu-hw-display-qxlUpgrade kvmUpgrade qemu-toolsUpgrade qemu-ppcUpgrade qemu-audio-paUpgrade qemu-audio-ossUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade xen-toolsUpgrade qemu-microvmUpgrade qemu-block-iscsiUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-armUpgrade qemu-ui-spice-appUpgrade qemu-langUpgrade xen-develUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ui-openglUpgrade qemu-chardev-spiceUpgrade qemu-hw-usb-redirectUpgrade qemu-block-sshUpgrade qemu-block-rbd | Nov 23, 2016 | Oct 5, 2016 |
| Ubuntu | — | Upgrade qemu-system-aarch64Upgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-system-ppcUpgrade qemu-system-mipsUpgrade qemu-system-miscUpgrade qemu-systemUpgrade qemu-system-armUpgrade qemu-system-s390xUpgrade qemu-kvm | Nov 9, 2016 | Oct 5, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub