CVE-2012-6075: Buffer Overflow
A buffer overflow flaw was found in the way e1000 emulated device driver of QEMU, a FAST! processor emulator, processed received large e1000 packets, when the SBP and LPE flags were disabled. If the underlying network was configured to allow large (jumbo) packets, a remote attacker could use this flaw to cause relevant guest in question to crash (DoS) or, potentially, the attacker could use this flaw to execute arbitrary code on the guest system with the kernel level privilege.
References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=696051 [2] http://www.openwall.com/lists/oss-security/2012/12/19/9 [3] http://thread.gmane.org/gmane.comp.emulators.qemu/182666 [4] http://www.openwall.com/lists/oss-security/2013/01/17/12
Relevant upstream patches: [5] http://git.qemu.org/?p=qemu.git;a=commitdiff;h=b0d9ffcd0251161c7c92f94804dcf599dfa3edeb http://git.qemu.org/?p=qemu.git;a=commitdiff;h=2c0331f4f7d241995452b99afaf0aab00493334a
Other sources
Buffer overflow in the e1000receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6075?
CVE-2012-6075 is classified as a high severity vulnerability due to its potential for remote exploitation through buffer overflow.
How do I fix CVE-2012-6075?
To fix CVE-2012-6075, upgrade the QEMU software to version 1.3.0 or later.
Which software versions are affected by CVE-2012-6075?
CVE-2012-6075 affects multiple versions of QEMU and Fedora, as well as specific versions of openSUSE and Red Hat Enterprise Linux.
What impact does CVE-2012-6075 have on systems?
CVE-2012-6075 allows remote attackers to execute arbitrary code on systems using affected versions of QEMU.
Is CVE-2012-6075 exploitable through the network?
Yes, CVE-2012-6075 can be exploited over the network by sending specially crafted large packets to an affected QEMU instance.