CVE-2015-8345
published 2017-04-13CVE-2015-8345: The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving…
PriorityP418medium6.5CVSS 3.1
AVLACLPRLUINSCCNINAH
EPSS
0.39%
31.9th percentile
The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | qemu | < qemu 1:2.5+dfsg-1 (bookworm) | qemu 1:2.5+dfsg-1 (bookworm) |
| qemu | qemu | <= 2.4.1 | — |
| qemu | qemu | — | — |
| qemu | qemu | >= 0 < 1:2.5+dfsg-1 | 1:2.5+dfsg-1 |
| qemu | qemu | >= 0 < 1:2.5+dfsg-1 | 1:2.5+dfsg-1 |
| qemu | qemu | >= 0 < 1:2.5+dfsg-1 | 1:2.5+dfsg-1 |
| qemu | qemu | >= 0 < 1:2.5+dfsg-1 | 1:2.5+dfsg-1 |
| qemu | qemu | >= 0 < 2.0.0+dfsg-2ubuntu1.21 | 2.0.0+dfsg-2ubuntu1.21 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2015-12-03·CVSS 5.0
CVE-2015-7295 [MEDIUM] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
Jason Wang discovered that QEMU incorrectly handled the virtio-net device.
A remote attacker could use this issue to cause guest network consumption,
resulting in a denial of service. (CVE-2015-7295)
Qinghao Tang and Ling Liu discovered that QEMU incorrectly handled the
pcnet driver when used in loopback mode. A malicious guest could use this
issue to cause a denial of service, or possibly execute arbitrary code on
the host as the user running the QEMU process. In the default installation,
when QEMU is used with libvirt, attackers would be isolated by the libvirt
AppArmor profile. (CVE-2015-7504)
Ling Liu and Jason Wang discovered that QEMU incorrectly handled the
pcnet driver. A remote attacker could use
Red Hat
Qemu: net: eepro100: infinite loop in processing command block list
vendor_redhat·2015-11-20·CVSS 6.5
CVE-2015-8345 [MEDIUM] CWE-835 Qemu: net: eepro100: infinite loop in processing command block list
Qemu: net: eepro100: infinite loop in processing command block list
The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.
An infinite-loop flaw was discovered in the QEMU emulator built with i8255x (PRO100) emulation support. When processing a chain of commands located in the Command Block List(CBL), each Command Block(CB) points to the next command in the list. If the link to the next CB pointed to the same block or if there was a closed loop in the chain, an infinite loop would execute the same command over and over again. A privileged user inside the guest could use this flaw to crash the QEMU instance, resulting in denial of service.
Statement: This issue
Debian
CVE-2015-8345: qemu - The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a...
vendor_debian·2015·CVSS 6.5
CVE-2015-8345 [MEDIUM] CVE-2015-8345: qemu - The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a...
The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.
Scope: local
bookworm: resolved (fixed in 1:2.5+dfsg-1)
bullseye: resolved (fixed in 1:2.5+dfsg-1)
forky: resolved (fixed in 1:2.5+dfsg-1)
sid: resolved (fixed in 1:2.5+dfsg-1)
trixie: resolved (fixed in 1:2.5+dfsg-1)
GHSA
GHSA-qh5w-h894-x9jx: The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors i
ghsa_unreviewed·2022-05-13
CVE-2015-8345 [MEDIUM] GHSA-qh5w-h894-x9jx: The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors i
The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.
OSV
CVE-2015-8345: The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors i
osv·2017-04-13·CVSS 6.5
CVE-2015-8345 [MEDIUM] CVE-2015-8345: The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors i
The eepro100 emulator in QEMU qemu-kvm blank allows local guest users to cause a denial of service (application crash and infinite loop) via vectors involving the command block list.
OSV
qemu, qemu-kvm vulnerabilities
osv·2015-12-03·CVSS 5.0
CVE-2015-7295 [MEDIUM] qemu, qemu-kvm vulnerabilities
qemu, qemu-kvm vulnerabilities
Jason Wang discovered that QEMU incorrectly handled the virtio-net device.
A remote attacker could use this issue to cause guest network consumption,
resulting in a denial of service. (CVE-2015-7295)
Qinghao Tang and Ling Liu discovered that QEMU incorrectly handled the
pcnet driver when used in loopback mode. A malicious guest could use this
issue to cause a denial of service, or possibly execute arbitrary code on
the host as the user running the QEMU process. In the default installation,
when QEMU is used with libvirt, attackers would be isolated by the libvirt
AppArmor profile. (CVE-2015-7504)
Ling Liu and Jason Wang discovered that QEMU incorrectly handled the
pcnet driver. A remote attacker could use this issue to cause a denial of
service, or possibl
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-8345 xen: Qemu: net: eepro100: infinite loop in processing command block list [fedora-all]
bugzilla·2015-11-25·CVSS 6.5
CVE-2015-8345 [MEDIUM] CVE-2015-8345 xen: Qemu: net: eepro100: infinite loop in processing command block list [fedora-all]
CVE-2015-8345 xen: Qemu: net: eepro100: infinite loop in processing command block list [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple
Bugzilla
CVE-2015-8345 Qemu: net: eepro100: infinite loop in processing command block list
bugzilla·2015-11-25·CVSS 6.5
CVE-2015-8345 [MEDIUM] CVE-2015-8345 Qemu: net: eepro100: infinite loop in processing command block list
CVE-2015-8345 Qemu: net: eepro100: infinite loop in processing command block list
Qemu emulator built with the i8255x (PRO100) emulation support is vulnerable
to an infinite loop issue. It could occur while processing a chain of commands
located in the Command Block List(CBL). Each Command Block(CB) points to the
next command in the list. An infinite loop unfolds if the link to the next
CB points to the same block or there is a closed loop in the chain.
A privileged(CAP_SYS_RAWIO) user inside guest could use this flaw to crash
the Qemu instance resulting in DoS.
Upstream patch:
-> https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.html
Reference:
-> http://www.openwall.com/lists/oss-security/2015/11/25/11
Discussion:
Created xen tracking bugs for this issue:
Affects: fed
Bugzilla
CVE-2015-8345 Qemu: net: eepro100: infinite loop in processing command block list [fedora-all]
bugzilla·2015-11-25·CVSS 6.5
CVE-2015-8345 [MEDIUM] CVE-2015-8345 Qemu: net: eepro100: infinite loop in processing command block list [fedora-all]
CVE-2015-8345 Qemu: net: eepro100: infinite loop in processing command block list [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple suppo
http://www.debian.org/security/2016/dsa-3469http://www.debian.org/security/2016/dsa-3470http://www.debian.org/security/2016/dsa-3471http://www.openwall.com/lists/oss-security/2015/11/25/11http://www.securityfocus.com/bid/77985https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.htmlhttps://security.gentoo.org/glsa/201602-01http://www.debian.org/security/2016/dsa-3469http://www.debian.org/security/2016/dsa-3470http://www.debian.org/security/2016/dsa-3471http://www.openwall.com/lists/oss-security/2015/11/25/11http://www.securityfocus.com/bid/77985https://lists.gnu.org/archive/html/qemu-devel/2015-10/msg03911.htmlhttps://security.gentoo.org/glsa/201602-01
2017-04-13
Published