Description
Heap-based buffer overflow in the bx_ne2k_c::rx_frame function in iodev/ne2k.cc in the emulated NE2000 device in Bochs 2.3 allows local users of the guest operating system to write to arbitrary memory locations and gain privileges on the host operating system via vectors that cause TXCNT register values to exceed the device memory size, aka "RX Frame heap overflow."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bochs | 2.3+20070705-1 | — |
| Debian 13 | bochs | 2.3+20070705-1 | — |
| Debian 12 | bochs | 2.3+20070705-1 | — |
| Debian 4.0 | bochs | 2.3-2etch1 | DSA-1351-1 |
| Debian 3.1 | bochs | 2.1.1+20041109-3sarge1 | DSA-1351-1 |
Advisories 1
- DSA-1351-1 bochs - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://bugs.gentoo.org/show_bug.cgi?id=188148
- 27715 third-party-advisory
- http://taviso.decsystem.org/virtsec.pdf
- 26364 third-party-advisory
- bochs-ne2000-bo(34508) vdb-entry
- GLSA-200711-21 vendor-advisory
- 36799 vdb-entry
- DSA-1351 vendor-advisory
- 24246 vdb-entry
- ADV-2007-1936 vdb-entry
- 25470 third-party-advisory