CVE-2016-1981

QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.

References

Affected packages

Git / github.com/qemu/qemu

Affected ranges

Type

GIT

Repo

https://github.com/qemu/qemu

Events

Introduced

Last affected

db51dfc1fcaf0027a5f266b7def4317605848c6a

Introduced

Last affected

823a3f11fb8f04c3c3cc0f95f968fef1bfc6534f

Introduced

Last affected

c1eb2ddf0f8075faddc5f7c3d39feae3e8e9d6b4

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5.1.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0"
        }
    ]
}

Affected versions

v0.*

v0.1.0

v0.1.1

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.11.0-rc0

v0.12.0-rc0

v0.13.0-rc0

v0.14.0-rc0

v0.15.0-rc0

v0.2.0

v0.3.0

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.5.0

v1.*

v1.0

v1.0-rc0

v1.0-rc1

v1.0-rc2

v1.0-rc3

v1.0-rc4

v1.1-rc0

v1.1-rc1

v1.1-rc2

v1.1.0

v1.1.0-rc2

v1.1.0-rc3

v1.1.0-rc4

v1.2.0

v1.2.0-rc0

v1.2.0-rc1

v1.2.0-rc2

v1.2.0-rc3

v1.3.0

v1.3.0-rc0

v1.3.0-rc1

v1.3.0-rc2

v1.4.0

v1.4.0-rc0

v1.4.0-rc1

v1.4.0-rc2

v1.5.0

v1.5.0-rc0

v1.5.0-rc1

v1.5.0-rc2

v1.5.0-rc3

v1.6.0

v1.6.0-rc0

v1.6.0-rc1

v1.6.0-rc2

v1.6.0-rc3

v1.7.0

v1.7.0-rc0

v1.7.0-rc1

v1.7.0-rc2

v2.*

v2.0.0

v2.0.0-rc0

v2.0.0-rc1

v2.0.0-rc2

v2.0.0-rc3

v2.1.0

v2.1.0-rc0

v2.1.0-rc1

v2.1.0-rc2

v2.1.0-rc3

v2.1.0-rc4

v2.1.0-rc5

v2.10.0

v2.10.0-rc0

v2.10.0-rc1

v2.10.0-rc2

v2.10.0-rc3

v2.10.0-rc4

v2.11.0

v2.11.0-rc0

v2.11.0-rc1

v2.11.0-rc2

v2.11.0-rc3

v2.11.0-rc4

v2.11.0-rc5

v2.12.0

v2.12.0-rc0

v2.12.0-rc1

v2.12.0-rc2

v2.12.0-rc3

v2.12.0-rc4

v2.2.0

v2.2.0-rc0

v2.2.0-rc1

v2.2.0-rc2

v2.2.0-rc3

v2.2.0-rc4

v2.2.0-rc5

v2.3.0

v2.3.0-rc0

v2.3.0-rc1

v2.3.0-rc2

v2.3.0-rc3

v2.3.0-rc4

v2.4.0

v2.4.0-rc0

v2.4.0-rc1

v2.4.0-rc2

v2.4.0-rc3

v2.4.0-rc4

v2.5.0

v2.5.0-rc0

v2.5.0-rc1

v2.5.0-rc2

v2.5.0-rc3

v2.5.0-rc4

v2.5.1

v2.5.1.1

v2.6.0

v2.6.0-rc0

v2.6.0-rc1

v2.6.0-rc2

v2.6.0-rc3

v2.6.0-rc4

v2.6.0-rc5

v2.7.0

v2.7.0-rc0

v2.7.0-rc1

v2.7.0-rc2

v2.7.0-rc3

v2.7.0-rc4

v2.7.0-rc5

v2.8.0

v2.8.0-rc0

v2.8.0-rc1

v2.8.0-rc2

v2.8.0-rc3

v2.8.0-rc4

v2.9.0

v2.9.0-rc0

v2.9.0-rc1

v2.9.0-rc2

v2.9.0-rc3

v2.9.0-rc4

v2.9.0-rc5

v3.*

v3.0.0

v3.0.0-rc0

v3.0.0-rc1

v3.0.0-rc2

v3.0.0-rc3

v3.0.0-rc4

v3.1.0

v3.1.0-rc0

v3.1.0-rc1

v3.1.0-rc2

v3.1.0-rc3

v3.1.0-rc4

v3.1.0-rc5

v4.*

v4.0.0

v4.0.0-rc0

v4.0.0-rc1

v4.0.0-rc2

v4.0.0-rc3

v4.0.0-rc4

v4.1.0

v4.1.0-rc0

v4.1.0-rc1

v4.1.0-rc2

v4.1.0-rc3

v4.1.0-rc4

v4.1.0-rc5

v4.2.0

v4.2.0-rc0

v4.2.0-rc1

v4.2.0-rc2

v4.2.0-rc3

v4.2.0-rc4

v4.2.0-rc5

v5.*

v5.0.0

v5.0.0-rc0

v5.0.0-rc1

v5.0.0-rc2

v5.0.0-rc3

v5.0.0-rc4

v5.1.0

v5.1.0-rc0

v5.1.0-rc1

v5.1.0-rc2

v5.1.0-rc3

v5.2.0

v5.2.0-rc0

v5.2.0-rc1

v5.2.0-rc2

v5.2.0-rc3

v5.2.0-rc4

v6.*

v6.0.0

v6.0.0-rc0

v6.0.0-rc1

v6.0.0-rc2

v6.0.0-rc3

v6.0.0-rc4

v6.0.0-rc5

v6.1.0

v6.1.0-rc0

v6.1.0-rc1

v6.1.0-rc2

v6.1.0-rc3

v6.1.0-rc4

v6.2.0

v6.2.0-rc0

v6.2.0-rc1

v6.2.0-rc3

v6.2.0-rc4

v7.*

v7.0.0

v7.0.0-rc0

v7.0.0-rc1

v7.0.0-rc2

v7.0.0-rc3

v7.0.0-rc4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1981.json"