CVE-2015-5278 — Infinite Loop in Qemu

CWE-835 — Infinite Loop11 documents8 sources
Severity
6.5MEDIUMNVD
EPSS
1.9%
top 16.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
QemuArista EOSCanonical Ubuntu Linux+1 more
Timeline
PublishedJan 23
Latest updateMay 24

Description

The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶NVDqemu/qemu< 2.4.0.1
▶Debianqemu/qemu< 1:2.4+dfsg-3+3
▶CVEListV5qemu/qemubefore 2.4.0.1
▶NVDarista/eos4 versions+3

Also affects: Fedora 21, 22, 23, Ubuntu Linux 12.04, 14.04, 15.04

Patches

Patch: www.openwall.com ↗Patch: lists.gnu.org ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-7423-57pf-4w2q: The ne2000_receive function in hw/net/ne2000↗2022-05-24
▶
OSV
CVE-2015-5278: The ne2000_receive function in hw/net/ne2000↗2020-01-23
▶
CVEList
CVE-2015-5278: The ne2000_receive function in hw/net/ne2000↗2020-01-23
▶
OSV
qemu, qemu-kvm vulnerabilities↗2015-09-24
▶

📋Vendor Advisories

3
Ubuntu
QEMU vulnerabilities↗2015-09-24
▶
Red Hat
qemu: Infinite loop in ne2000_receive() function↗2015-09-15
▶
Debian
CVE-2015-5278: qemu - The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows att...↗2015
▶

💬Community

3
Bugzilla
CVE-2015-5278 qemu: Infinite loop in ne2000_receive() function [fedora-all]↗2015-09-15
▶
Bugzilla
CVE-2015-5278 xen: qemu: Infinite loop in ne2000_receive() function [fedora-all]↗2015-09-15
▶
Bugzilla
CVE-2015-5278 qemu: Infinite loop in ne2000_receive() function↗2015-08-25
▶
CVE-2015-5278 — Infinite Loop in Qemu | cvebase