Описание
The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | released | 1:2.6.1+dfsg-0ubuntu9 |
| esm-infra-legacy/trusty | not-affected | 2.0.0+dfsg-2ubuntu1.30 |
| esm-infra/xenial | not-affected | 1:2.5+dfsg-5ubuntu10.6 |
| precise | DNE | |
| trusty | released | 2.0.0+dfsg-2ubuntu1.30 |
| trusty/esm | not-affected | 2.0.0+dfsg-2ubuntu1.30 |
| upstream | needs-triage | |
| vivid/stable-phone-overlay | DNE | |
| vivid/ubuntu-core | DNE | |
| xenial | released | 1:2.5+dfsg-5ubuntu10.6 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-infra-legacy/trusty | DNE | |
| precise | released | 1.0+noroms-0ubuntu14.31 |
| trusty | DNE | |
| trusty/esm | DNE | |
| upstream | needs-triage | |
| vivid/stable-phone-overlay | DNE | |
| vivid/ubuntu-core | DNE | |
| xenial | DNE | |
| yakkety | DNE |
Показывать по
EPSS
2.1 Low
CVSS2
4.4 Medium
CVSS3
Связанные уязвимости
The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emul ...
The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.
EPSS
2.1 Low
CVSS2
4.4 Medium
CVSS3