CVE-2016-1981

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-1981
QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

2.1 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2016-2585.html Third Party Advisory
http://www.debian.org/security/2016/dsa-3469 Third Party Advisory
http://www.debian.org/security/2016/dsa-3470 Third Party Advisory
http://www.debian.org/security/2016/dsa-3471 Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/01/19/10 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/01/22/1 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/81549 Third Party Advisory VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1298570 Issue Tracking
https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg03454.html Patch Vendor Advisory
https://security.gentoo.org/glsa/201604-01 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
History

12 Feb 2023, 23:17

Type Values Removed Values Added
Summary An infinite loop flaw was found in the way QEMU's e1000 NIC emulation implementation processed data using transmit or receive descriptors under certain conditions. A privileged user inside a guest could use this flaw to crash the QEMU instance. QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2016-1981', 'name': 'https://access.redhat.com/security/cve/CVE-2016-1981', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:2585', 'name': 'https://access.redhat.com/errata/RHSA-2016:2585', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 21:16

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2016-1981 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:2585 -
Summary QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS. An infinite loop flaw was found in the way QEMU's e1000 NIC emulation implementation processed data using transmit or receive descriptors under certain conditions. A privileged user inside a guest could use this flaw to crash the QEMU instance.
Information

Published : 2016-12-29 22:59

Updated : 2023-12-10 12:01

NVD link : CVE-2016-1981

Mitre link : CVE-2016-1981

CVE.ORG link : CVE-2016-1981

JSON object : View

Products Affected

debian

  • debian_linux

qemu

  • qemu
CWE
CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')