CVE-2021-20257: Medium severity qemu vulnerability
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in processtxdesc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Other sources
An infinite loop issue was found in the e1000 NIC emulator of the QEMU. It occurs while processing transmit (tx) descriptors in processtxdesc, if various descriptor fields are initialised with invalid values. A guest may use this flaw to consume cpu cycles on the host resulting in DoS scenario.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg03595.html
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-20257?
CVE-2021-20257 is an infinite loop flaw in the e1000 NIC emulator of QEMU, which allows a guest to consume CPU cycles on the host, resulting in a denial of service.
Which software is affected by CVE-2021-20257?
QEMU, Fedora, Redhat Openstack Platform, Redhat Enterprise Linux, Redhat Codeready Linux Builder, and Debian Linux are affected by CVE-2021-20257.
What is the severity of CVE-2021-20257?
CVE-2021-20257 has a severity rating of medium (6.5).
How can I fix CVE-2021-20257 in Ubuntu?
To fix CVE-2021-20257 in Ubuntu, update the 'qemu' package to version 2.11+dfsg-1ubuntu7.37 (for Bionic), 4.2-3ubuntu6.17 (for Focal), or 5.0-5ubuntu9.9 (for Groovy).
How can I fix CVE-2021-20257 in Debian?
To fix CVE-2021-20257 in Debian, update the 'qemu' package to version 3.1+dfsg-8+deb10u11, 5.2+dfsg-11+deb11u3, 5.2+dfsg-11+deb11u2, 7.2+dfsg-7+deb12u2, or 8.1.2+ds-1.