CVE-2016-1981

NameCVE-2016-1981
DescriptionQEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-3469-1, DSA-3470-1, DSA-3471-1
NVD severitylow (attack range: local)
Debian Bugs812307

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qemu (PTS)wheezy1.1.2+dfsg-6a+deb7u12fixed
wheezy (security)1.1.2+dfsg-6+deb7u24fixed
jessie (security), jessie1:2.1+dfsg-12+deb8u6fixed
stretch1:2.8+dfsg-6+deb9u2fixed
stretch (security)1:2.8+dfsg-6+deb9u3fixed
buster, sid1:2.10.0+dfsg-2fixed
qemu-kvm (PTS)wheezy1.1.2+dfsg-6+deb7u12fixed
wheezy (security)1.1.2+dfsg-6+deb7u24fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
qemusource(unstable)1:2.5+dfsg-5low812307
qemusourcejessie1:2.1+dfsg-12+deb8u5alowDSA-3471-1
qemusourcesqueeze(unfixed)end-of-life
qemusourcewheezy1.1.2+dfsg-6a+deb7u12lowDSA-3469-1
qemu-kvmsource(unstable)(unfixed)low
qemu-kvmsourcesqueeze(unfixed)end-of-life
qemu-kvmsourcewheezy1.1.2+dfsg-6+deb7u12lowDSA-3470-1

Notes

[squeeze] - qemu <end-of-life> (Not supported in Squeeze LTS)
[squeeze] - qemu-kvm <end-of-life> (Not supported in Squeeze LTS)
Upstream patch: https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg03454.html
Introduced in http://git.qemu.org/?p=qemu.git;a=commit;h=7c23b8920329180f48b8a147b629d8837709d201 (v0.10.0)
https://bugzilla.redhat.com/show_bug.cgi?id=1298570
http://www.openwall.com/lists/oss-security/2016/01/19/10

Search for package or bug name: Reporting problems