Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-3qx7-ff8p-6j2r

Опубликовано: 05 июл. 2024
Источник: github
Github: Не прошло ревью
CVSS3: 6

Описание

A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.

A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.

EPSS

Процентиль: 29%
0.00102
Низкий

6 Medium

CVSS3

Дефекты

CWE-125

Связанные уязвимости

CVSS3: 6.8
ubuntu
около 1 года назад

A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.

CVSS3: 6.8
redhat
около 1 года назад

A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.

CVSS3: 6.8
nvd
около 1 года назад

A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.

CVSS3: 6.8
msrc
4 месяца назад

Описание отсутствует

CVSS3: 6.8
debian
около 1 года назад

A flaw was found in the virtio-net device in QEMU. When enabling the R ...

EPSS

Процентиль: 29%
0.00102
Низкий

6 Medium

CVSS3

Дефекты

CWE-125