The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemuUpgrade qemu-kvm | Mar 31, 2017 | Oct 5, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Oct 5, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-img | Dec 4, 2019 | Oct 5, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-img | Apr 16, 2020 | Oct 5, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm | Nov 19, 2019 | Oct 5, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 21, 2016 |
| Suse | — | Upgrade qemu-ui-openglUpgrade xen-develUpgrade qemu-hw-usb-redirectUpgrade qemu-block-iscsiUpgrade qemu-ui-gtkUpgrade qemu-ui-spice-coreUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-vgabiosUpgrade qemu-audio-paUpgrade qemuUpgrade qemu-microvmUpgrade xen-tools-xendomains-wait-diskUpgrade xen-toolsUpgrade qemu-s390xUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-armUpgrade qemu-hw-display-qxlUpgrade xen-tools-domuUpgrade qemu-audio-ossUpgrade qemu-sgabiosUpgrade qemu-chardev-spiceUpgrade qemu-ui-spice-appUpgrade qemu-ppcUpgrade qemu-block-sshUpgrade qemu-s390Upgrade qemu-toolsUpgrade kvmUpgrade qemu-hw-display-virtio-gpuUpgrade xenUpgrade qemu-audio-spiceUpgrade xen-libsUpgrade qemu-ui-cursesUpgrade qemu-audio-alsaUpgrade qemu-guest-agentUpgrade qemu-block-rbdUpgrade qemu-langUpgrade qemu-block-curlUpgrade qemu-skibootUpgrade qemu-ipxeUpgrade xen-doc-pdfUpgrade xen-kmp-paeUpgrade qemu-kvmUpgrade qemu-x86Upgrade xen-kmp-traceUpgrade xen-kmp-defaultUpgrade qemu-chardev-baumUpgrade qemu-seabiosUpgrade xen-libs-32bitUpgrade qemu-ksmUpgrade xen-doc-htmlUpgrade qemu-hw-display-virtio-vga | Nov 23, 2016 | Oct 5, 2016 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-s390xUpgrade qemu-kvmUpgrade qemu-systemUpgrade qemu-system-aarch64Upgrade qemu-system-mipsUpgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-system-x86Upgrade qemu-system-sparc | Nov 9, 2016 | Oct 5, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub