DescriptionThe (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs781250

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qemu (PTS)buster1:3.1+dfsg-8+deb10u8fixed
buster (security)1:3.1+dfsg-8+deb10u11fixed
bullseye (security)1:5.2+dfsg-11+deb11u2fixed
sid, trixie1:8.2.1+ds-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs


[wheezy] - qemu <postponed> (Can be fixed along in later update)
[wheezy] - qemu-kvm <postponed> (Can be fixed along in later update);a=commitdiff;h=3251bdcf1c67427d964517053c3d185b46e618e8 (v2.2.0-rc2)
Per maintainer not a security issue:
Qemu either leaks memory or loops infinitely. Memory leakage can be easily
mitigated using some kind of resource limits in security-sensitive environments,
and looping can trivially be done inside the virtual machine just fine, achieving
the same effect

Search for package or bug name: Reporting problems