CVE-2017-6058: Buffer Overflow
Buffer overflow in NetRxPkt::ehdrbuf in hw/net/netrxpkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the vmxnet3 device, allows remote attackers to cause a denial of service (out-of-bounds access and QEMU process crash) via vectors related to VLAN stripping.
Other sources
Quick Emulator(Qemu) built with the VMWARE VMXNET3 NIC device support is vulnerable to an out-of-bounds access issue. It could occur while stripping VLAN header from 'ethbuf' buffer in receiving packets.
A remote user/process could use this issue to crash Qemu process instance resulting in DoS.
Note:- It requires 'VLANSTRIP' feature is enabled on the vmxnet3 device.
Upstream patch: --------------- -> https://lists.nongnu.org/archive/html/qemu-devel/2017-02/msg03527.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/02/17/2
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the VLANSTRIP feature on the vmxnet3 device in the affected QEMU configuration, since the out-of-bounds access/DoS requires VLANSTRIP to be enabled.
QEMU (hw/net/net_rx_pkt.c / vmxnet3) VLANSTRIP feature on vmxnet3 = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6058?
CVE-2017-6058 has a severity rating that signifies a denial of service risk due to a buffer overflow vulnerability.
How do I fix CVE-2017-6058?
To fix CVE-2017-6058, upgrade QEMU to a version greater than 2.8.1.1 to mitigate the buffer overflow vulnerability.
What software is affected by CVE-2017-6058?
CVE-2017-6058 affects QEMU versions up to and including 2.8.1.1 when the VLANSTRIP feature is enabled.
What type of attack does CVE-2017-6058 allow?
CVE-2017-6058 allows remote attackers to execute a denial of service attack, leading to an out-of-bounds access and crash of the QEMU process.
What feature in QEMU is linked to CVE-2017-6058?
The buffer overflow vulnerability in CVE-2017-6058 is linked to the VLANSTRIP feature when used with the vmxnet3 device.