CVE-2015-7512
published 2016-01-08CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of…
PriorityP355critical9CVSS 3.1
AVNACHPRNUINSCCHIHAH
EPSS
7.73%
94.0th percentile
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | qemu | < qemu 1:2.5+dfsg-1 (bookworm) | qemu 1:2.5+dfsg-1 (bookworm) |
| oracle | linux | — | — |
| qemu | qemu | <= 2.4.1 | — |
| qemu | qemu | — | — |
| qemu | qemu | >= 0 < 1:2.5+dfsg-1 | 1:2.5+dfsg-1 |
| qemu | qemu | >= 0 < 1:2.5+dfsg-1 | 1:2.5+dfsg-1 |
| qemu | qemu | >= 0 < 1:2.5+dfsg-1 | 1:2.5+dfsg-1 |
| qemu | qemu | >= 0 < 1:2.5+dfsg-1 | 1:2.5+dfsg-1 |
| qemu | qemu | >= 0 < 2.0.0+dfsg-2ubuntu1.21 | 2.0.0+dfsg-2ubuntu1.21 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | openstack | — | — |
| redhat | virtualization | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability is in the pcnet_receive function in hw/net/pcnet.c; monitor for QEMU processes handling AMD PC-Net II (pcnet) NIC emulation in non-loopback mode receiving oversized packets that exceed the guest NIC MTU. ↗
- →Exploitation requires the guest NIC to be configured with a larger-than-normal MTU limit; alert on QEMU guest configurations where the pcnet adapter MTU is set above standard (1500 bytes). ↗
- →The pcnet backend driver must be explicitly enabled per-guest; flag any QEMU/KVM guest configurations that explicitly enable the AMD PCNet adapter (e.g., -net nic,model=pcnet), as it is not enabled by default. ↗
- ·QEMU on RHEL 7 and RHEV 3 (RHEL 7 base) are NOT affected because the pcnet backend driver is not enabled in those builds. ↗
- ·Exploitation is only possible in non-loopback mode when a remote attacker sends a large packet to a guest with a larger-than-default MTU; loopback-mode exploitation is a separate issue (CVE-2015-7504). ↗
- ·When QEMU is used with libvirt, exploitation impact is reduced because attackers would be isolated by the libvirt AppArmor profile. ↗
CVSS provenance
nvdv3.19.0CRITICALCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv9.0CRITICAL
vendor_debian9.0CRITICAL
vendor_redhat9.0CRITICAL
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4583-4mx5-3jcc: Buffer overflow in the pcnet_receive function in hw/net/pcnet
ghsa_unreviewed·2022-05-13
CVE-2015-7512 [CRITICAL] CWE-120 GHSA-4583-4mx5-3jcc: Buffer overflow in the pcnet_receive function in hw/net/pcnet
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.
OSV
CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet
osv·2016-01-08·CVSS 9.0
CVE-2015-7512 [CRITICAL] CVE-2015-7512: Buffer overflow in the pcnet_receive function in hw/net/pcnet
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.
OSV
qemu, qemu-kvm vulnerabilities
osv·2015-12-03·CVSS 5.0
CVE-2015-7295 [MEDIUM] qemu, qemu-kvm vulnerabilities
qemu, qemu-kvm vulnerabilities
Jason Wang discovered that QEMU incorrectly handled the virtio-net device.
A remote attacker could use this issue to cause guest network consumption,
resulting in a denial of service. (CVE-2015-7295)
Qinghao Tang and Ling Liu discovered that QEMU incorrectly handled the
pcnet driver when used in loopback mode. A malicious guest could use this
issue to cause a denial of service, or possibly execute arbitrary code on
the host as the user running the QEMU process. In the default installation,
when QEMU is used with libvirt, attackers would be isolated by the libvirt
AppArmor profile. (CVE-2015-7504)
Ling Liu and Jason Wang discovered that QEMU incorrectly handled the
pcnet driver. A remote attacker could use this issue to cause a denial of
service, or possibl
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2015-12-03·CVSS 5.0
CVE-2015-7295 [MEDIUM] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
Jason Wang discovered that QEMU incorrectly handled the virtio-net device.
A remote attacker could use this issue to cause guest network consumption,
resulting in a denial of service. (CVE-2015-7295)
Qinghao Tang and Ling Liu discovered that QEMU incorrectly handled the
pcnet driver when used in loopback mode. A malicious guest could use this
issue to cause a denial of service, or possibly execute arbitrary code on
the host as the user running the QEMU process. In the default installation,
when QEMU is used with libvirt, attackers would be isolated by the libvirt
AppArmor profile. (CVE-2015-7504)
Ling Liu and Jason Wang discovered that QEMU incorrectly handled the
pcnet driver. A remote attacker could use
Red Hat
Qemu: net: pcnet: buffer overflow in non-loopback mode
vendor_redhat·2015-11-30·CVSS 9.0
CVE-2015-7512 [CRITICAL] CWE-122 Qemu: net: pcnet: buffer overflow in non-loopback mode
Qemu: net: pcnet: buffer overflow in non-loopback mode
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.
A buffer overflow flaw was found in the way QEMU's AMD PC-Net II emulation validated certain received packets from a remote host in non-loopback mode. A remote, unprivileged attacker could potentially use this flaw to execute arbitrary code on the host with the privileges of the QEMU process. Note that to exploit this flaw, the guest network interface must have a large MTU limit.
Statement: This issue does not affect the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 7 as they do not e
Debian
CVE-2015-7512: qemu - Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a ...
vendor_debian·2015·CVSS 9.0
CVE-2015-7512 [CRITICAL] CVE-2015-7512: qemu - Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a ...
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.
Scope: local
bookworm: resolved (fixed in 1:2.5+dfsg-1)
bullseye: resolved (fixed in 1:2.5+dfsg-1)
forky: resolved (fixed in 1:2.5+dfsg-1)
sid: resolved (fixed in 1:2.5+dfsg-1)
trixie: resolved (fixed in 1:2.5+dfsg-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mode [fedora-all]
bugzilla·2015-11-30·CVSS 9.0
CVE-2015-7512 [CRITICAL] CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mode [fedora-all]
CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mode [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions
Bugzilla
CVE-2015-7512 xen: Qemu: net: pcnet: buffer overflow in non-loopback mode [fedora-all]
bugzilla·2015-11-30·CVSS 9.0
CVE-2015-7512 [CRITICAL] CVE-2015-7512 xen: Qemu: net: pcnet: buffer overflow in non-loopback mode [fedora-all]
CVE-2015-7512 xen: Qemu: net: pcnet: buffer overflow in non-loopback mode [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ver
Bugzilla
CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mode
bugzilla·2015-11-24·CVSS 9.0
CVE-2015-7512 [CRITICAL] CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mode
CVE-2015-7512 Qemu: net: pcnet: buffer overflow in non-loopback mode
The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving packets from a
remote host(non-loopback mode), fails to validate the received data size,
thus resulting in a buffer overflow issue. It could potentially lead to
arbitrary code execution on the host, with privileges of the Qemu process.
It requires the guest NIC to have larger MTU limit.
A remote user could use this flaw to crash the guest instance resulting in DoS
or potentially execute arbitrary code on a remote host with privileges of the
Qemu process.
Upstream fix:
-> http://git.qemu.org/?p=qemu.git;a=commit;h=8b98a2f07175d46c3f7217639bd5e03f
Reference:
-> http://www.openwall.com/lists/oss-security/2015/11/30/3
Discussion:
Statement:
This issue does not
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8b98a2f07175d46c3f7217639bd5e03fhttp://rhn.redhat.com/errata/RHSA-2015-2694.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2695.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2696.htmlhttp://www.debian.org/security/2016/dsa-3469http://www.debian.org/security/2016/dsa-3470http://www.debian.org/security/2016/dsa-3471http://www.openwall.com/lists/oss-security/2015/11/30/3http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/78230http://www.securitytracker.com/id/1034527https://security.gentoo.org/glsa/201602-01http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8b98a2f07175d46c3f7217639bd5e03fhttp://rhn.redhat.com/errata/RHSA-2015-2694.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2695.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2696.htmlhttp://www.debian.org/security/2016/dsa-3469http://www.debian.org/security/2016/dsa-3470http://www.debian.org/security/2016/dsa-3471http://www.openwall.com/lists/oss-security/2015/11/30/3http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/78230http://www.securitytracker.com/id/1034527https://security.gentoo.org/glsa/201602-01
2016-01-08
Published