CVE-2020-28916: Medium severity qemu vulnerability
An infinite loop flaw was found in the e1000e device emulator in QEMU. This issue could occur while receiving packets via the e1000ewritepackettoguest() routine, if the receive(RX) descriptor has a NULL buffer address. This flaw allows a privileged guest user to cause a denial of service. The highest threat from this vulnerability is to system availability.
Other sources
An infinite loop issue was found in the e1000e device emulator in QEMU. The issue could occur while receiving packets via e1000ewritepackettoguest() routine, if the receive(RX) descriptor has NULL buffer address. A privileged guest user may use this flaw to induce a DoS scenario in the host.
Upstream patch: --------------- -> https://lists.nongnu.org/archive/html/qemu-devel/2020-11/msg03185.html
— Red Hat
hw/net/e1000ecore.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue in QEMU?
The vulnerability ID for this issue in QEMU is CVE-2020-28916.
What is the severity of CVE-2020-28916?
The severity of CVE-2020-28916 is medium (CVSS score of 5.5).
How does the vulnerability in QEMU occur?
The vulnerability in QEMU occurs due to an infinite loop in the e1000e device emulator while receiving packets with a NULL buffer address in the RX descriptor.
What is the impact of CVE-2020-28916?
The impact of CVE-2020-28916 is a denial of service, allowing a privileged guest user to cause the system to enter an infinite loop.
How can I fix the CVE-2020-28916 vulnerability in QEMU?
To fix the CVE-2020-28916 vulnerability in QEMU, update to version 5.2.0 or later.