CVE-2017-6058
HighSummary
Buffer overflow in NetRxPkt::ehdr_buf in QEMU when the VLANSTRIP feature is enabled on the vmxnet3 device allows remote attackers to cause a denial of service via out-of-bounds access, leading to a QEMU process crash.
Risk Assessment
Attackers can exploit this vulnerability to remotely disrupt QEMU services, potentially causing downtime for virtual machines.
Recommendation
It is recommended to disable the VLANSTRIP feature on the vmxnet3 device and update QEMU to the latest version to mitigate the risk.
Other vulnerabilities in QEMU (Quick Emulator)
See all- CVE-2017-14167High
Integer overflow in the load_multiboot function in QEMU allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, triggering an out-of-bounds write.
- CVE-2017-5931High
Integer overflow in hw/virtio/virtio-crypto.c in QEMU allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request, triggering a heap-based buffer overflow.
Original NVD description (English source)
Buffer overflow in NetRxPkt::ehdr_buf in hw/net/net_rx_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the vmxnet3 device, allows remote attackers to cause a denial of service (out-of-bounds access and QEMU process crash) via vectors related to VLAN stripping.