CVE-2018-20216: High severity Qemu Qemu vulnerability
Published Dec 20, 2018
·Updated
Last updated 25 August 2025
Other sources
QEMU can have an infinite loop in hw/rdma/vmw/pvrdmadevring.c because return values are not checked (and -1 is mishandled).
— Launchpad
Affected Software
6 affected componentsFixes available
Qemu Qemu<=3.1.0
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=18.10
debian/qemu
1:5.2+dfsg-11+deb11u31:5.2+dfsg-11+deb11u51:7.2+dfsg-7+deb12u181:7.2+dfsg-7+deb12u151:10.0.7+ds-0+deb13u11:10.0.2+ds-2+deb13u11:10.2.1+ds-1
Remediation
Patch Available
Event History
Dec 20, 2018
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Jan 11, 2024
Data Sourced
via Launchpad·10:58 PM
Description
Feb 20, 2026
Data Sourced
via Ubuntu·05:44 PM
RemedyDescriptionSeverityAffected Software
Feb 23, 2026
Data Sourced
via Debian·04:00 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-20216?
CVE-2018-20216 is considered a moderate severity vulnerability due to the potential for an infinite loop in the affected software.
2
How do I fix CVE-2018-20216?
To fix CVE-2018-20216, you should update QEMU to a patched version that properly checks return values.
3
Which versions of QEMU are affected by CVE-2018-20216?
CVE-2018-20216 affects QEMU versions up to and including 3.1.0.
4
What systems are vulnerable to CVE-2018-20216?
CVE-2018-20216 impacts various versions of QEMU installed on Debian and Ubuntu systems.
5
What could happen if CVE-2018-20216 is exploited?
Exploitation of CVE-2018-20216 could lead to an infinite loop, potentially causing denial of service on the affected system.