CVE-2016-4002: Buffer Overflow
Buffer overflow in the mipsnetreceive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes.
Other sources
Qemu emulator built with the MIPSnet controller emulator is vulnerable to a buffer overflow issue. It could occur while receiving network packets in mipsnetreceive(), if the guest NIC is configured to accept large(MTU) packets.
A remote user/process could use this flaw to crash Qemu resulting in DoS; OR potentially execute arbitrary code with privileges of the Qemu process on a host.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01131.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/04/11/6
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4002?
CVE-2016-4002 has a severity that can lead to denial of service or potential remote code execution.
How do I fix CVE-2016-4002?
To fix CVE-2016-4002, upgrade QEMU to a version that includes the patch addressing this buffer overflow vulnerability.
Which software versions are affected by CVE-2016-4002?
CVE-2016-4002 affects multiple versions of QEMU up to and including 2.6.2 as well as specific versions of Fedora, Ubuntu, and Debian.
What types of attacks can be executed using CVE-2016-4002?
CVE-2016-4002 allows remote attackers to cause memory corruption and potentially execute arbitrary code via oversized packets.
Is CVE-2016-4002 a local or remote vulnerability?
CVE-2016-4002 is considered a remote vulnerability because it can be exploited over a network by attackers.