CVE-2014-3640: Null Pointer Dereference
The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.
Other sources
When guest sends udp packet with source port and source addr 0, uninitialized socket is picked up when looking for matching and already created udp sockets, and later passed to sosendto() where NULL pointer dereference is hit during so->slirp->vnetworkmask.saddr access.
Only guests using qemu user networking are affected.
Acknowledgements:
Red Hat would like to thank Xavier Mehrenberger and Stephane Duverger of Airbus for reporting this issue.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3640?
CVE-2014-3640 is classified as a denial of service vulnerability due to a NULL pointer dereference.
How do I fix CVE-2014-3640?
To mitigate CVE-2014-3640, you should upgrade QEMU to version 2.1.2 or later.
Who is affected by CVE-2014-3640?
CVE-2014-3640 affects QEMU versions prior to 2.1.2 as well as certain versions of Debian and Red Hat Enterprise Linux.
What type of vulnerability is CVE-2014-3640?
CVE-2014-3640 is a denial of service vulnerability that can be exploited by sending specially crafted UDP packets.
Can CVE-2014-3640 be exploited remotely?
CVE-2014-3640 is primarily a local exploit, as it requires local user access to send crafted UDP packets.