CVE-2018-10839: Integer Overflow
An integer overflow issue was found in the NE200 NIC emulation. It could occur while receiving packets from the network, if the size value was greater than INTMAX. Such overflow would lead to stack buffer overflow issue. A user inside guest could use this flaw to crash the QEMU process, resulting in DoS scenario.
Other sources
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
Qemu emulator built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network.
A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
Upstream fix: ------------- -> https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03273.html
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2018/10/08/1
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-10839.
What is the severity of CVE-2018-10839?
The severity of CVE-2018-10839 is medium.
What is the affected software for CVE-2018-10839?
The affected software for CVE-2018-10839 includes qemu-kvm version 2:0.12.1.2-2.506.el6_10.5, qemu versions 1:2.8+dfsg-6+deb9u5 to 1:2.12+dfsg-3, and various versions of qemu on Ubuntu and Debian systems.
What is the impact of CVE-2018-10839?
The impact of CVE-2018-10839 is a stack buffer overflow issue that could be exploited by a user inside the guest to crash the QEMU process.
How can I fix CVE-2018-10839?
To fix CVE-2018-10839, you should update qemu to a fixed version provided by the software vendor or apply the appropriate patches.