CVE-2021-20257: Medium severity Qemu Qemu vulnerability
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in processtxdesc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Other sources
An infinite loop issue was found in the e1000 NIC emulator of the QEMU. It occurs while processing transmit (tx) descriptors in processtxdesc, if various descriptor fields are initialised with invalid values. A guest may use this flaw to consume cpu cycles on the host resulting in DoS scenario.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg03595.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u2Fixed in 1:7.2+dfsg-7+deb12u12Fixed in 1:10.0.0~rc2+ds-2Fixed in 1:10.0.0~rc3+ds-2 - Upgrade
Upgrade
alpine/qemuto a version that resolves this vulnerability.Fixed in 6.1.1-r0
Event History
Frequently Asked Questions
What is CVE-2021-20257?
CVE-2021-20257 is an infinite loop flaw in the e1000 NIC emulator of QEMU, which allows a guest to consume CPU cycles on the host, resulting in a denial of service.
Which software is affected by CVE-2021-20257?
QEMU, Fedora, Redhat Openstack Platform, Redhat Enterprise Linux, Redhat Codeready Linux Builder, and Debian Linux are affected by CVE-2021-20257.
What is the severity of CVE-2021-20257?
CVE-2021-20257 has a severity rating of medium (6.5).
How can I fix CVE-2021-20257 in Ubuntu?
To fix CVE-2021-20257 in Ubuntu, update the 'qemu' package to version 2.11+dfsg-1ubuntu7.37 (for Bionic), 4.2-3ubuntu6.17 (for Focal), or 5.0-5ubuntu9.9 (for Groovy).
How can I fix CVE-2021-20257 in Debian?
To fix CVE-2021-20257 in Debian, update the 'qemu' package to version 3.1+dfsg-8+deb10u11, 5.2+dfsg-11+deb11u3, 5.2+dfsg-11+deb11u2, 7.2+dfsg-7+deb12u2, or 8.1.2+ds-1.