Fabrice Bellard QEMU e1000 hw/net/e1000.c process_tx_desc infinite loop

Summaryinfo

A vulnerability described as problematic has been identified in Fabrice Bellard QEMU. This affects the function process_tx_desc of the file hw/net/e1000.c of the component e1000. The manipulation results in infinite loop. This vulnerability was named CVE-2015-6815. The attack needs to be approached within the local network. There is no available exploit. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in Fabrice Bellard QEMU (Virtualization Software) (unknown version). It has been classified as problematic. Affected is the function process_tx_desc of the file hw/net/e1000.c of the component e1000. The manipulation with an unknown input leads to a infinite loop vulnerability. CWE is classifying the issue as CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. This is going to have an impact on availability. CVE summarizes:

The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.

The weakness was presented 03/18/2023. This vulnerability is traded as CVE-2015-6815 since 09/05/2015. The exploitability is told to be easy. Access to the local network is required for this attack. The requirement for exploitation is a authentication. There are known technical details, but no exploit is available.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 168292 (SUSE Enterprise Linux Security update for xen (SUSE-SU-2015:2324-1)).

Applying a patch is able to eliminate this problem. The advisory contains the following remark:

While processing transmit descriptors, it could lead to an infinite loop if 'bytes' was to become zero; Add a check to avoid it. [The guest can force 'bytes' to 0 by setting th

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Virtualization Software

Vendor

• Fabrice Bellard

Name

• QEMU

License

• open-source

Website

• Vendor: https://bellard.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion