Description
Heap-based buffer overflow in the process_tx_desc function in the e1000 emulation (hw/e1000.c) in qemu-kvm 0.12, and possibly other versions, allows guest OS users to cause a denial of service (QEMU crash) and possibly execute arbitrary code via crafted legacy mode packets.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 | — |
| Debian 13 | xen | 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 | — |
| Debian 12 | xen | 4.1.3~rc1+hg-20120614.a9c0a89c08f2-1 | — |
| Debian 6.0 | qemu-kvm | 0.12.5+dfsg-5+squeeze8 | DSA-2396-1 |
| Debian 6.0 | xen-qemu-dm-4.0 | 4.0.1-2+squeeze1 | DSA-2404-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | qemu-img +2 | 2:0.12.1.2-2.209.el6_2.4 | RHSA-2012:0050 |
| RHEL 6 | rhev-hypervisor6 +1 | 6.2-20120209.0.el6_2 | RHSA-2012:0109 |
| RHEL 5 | xen +1 | 3.0.3-135.el5_8.2 | RHSA-2012:0370 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Virtualization 5 | kvm +4 | 83-239.el5_7.1 | RHSA-2012:0051 |
| Red Hat Rhel Virtualization 5 | xen +1 | 3.0.3-135.el5_8.2 | RHSA-2012:0370 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xen | 4.7.0_12-1.3 | openSUSE-SU-2024:10196-1 |
Advisories 7
- RHSA-2012:0370 Red Hat Security Advisory: xen security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:0109 Red Hat Security Advisory: rhev-hypervisor6 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:0051 Red Hat Security Advisory: kvm security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:0050 Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2396-1 qemu-kvm - buffer underflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2404-1 xen-qemu-dm-4.0 - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10196-1 xen-4.7.0_12-1.3 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- qemu-processtxdesc-bo(72656) vdb-entry
- 47741 third-party-advisory
- http://git.qemu.org/?p=qemu.git%3Ba=log%3Bh=refs/heads/stable-1.0
- 47992 third-party-advisory
- 48318 third-party-advisory
- 47740 third-party-advisory
- RHSA-2012:0050 vendor-advisory
- openSUSE-SU-2012:0207 vendor-advisory
- USN-1339-1 vendor-advisory
- 51642 vdb-entry
- 50913 third-party-advisory
- SUSE-SU-2012:1320 vendor-advisory
- RHSA-2012:0370 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=772075
- FEDORA-2012-8604 vendor-advisory