CVE-2015-8701

QEMU (aka Quick Emulator) built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit (tx) descriptors in 'tx_consume' routine, if a descriptor was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments. A privileged user inside guest could use this flaw to cause memory leakage on the host or crash the QEMU process instance resulting in DoS issue.
Configurations

Configuration 1 (hide)

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2016-12-29 22:59

Updated : 2024-02-04 19:11


NVD link : CVE-2015-8701

Mitre link : CVE-2015-8701

CVE.ORG link : CVE-2015-8701


JSON object : View

Products Affected

qemu

  • qemu
CWE
CWE-193

Off-by-one Error