Description
Buffer overflow in NetRxPkt::ehdr_buf in hw/net/net_rx_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the vmxnet3 device, allows remote attackers to cause a denial of service (out-of-bounds access and QEMU process crash) via vectors related to VLAN stripping.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:2.8+dfsg-3 | — |
| Debian 13 | qemu | 1:2.8+dfsg-3 | — |
| Debian 12 | qemu | 1:2.8+dfsg-3 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | qemu | 6.1.0-32.1 | openSUSE-SU-2024:11287-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | qemu +12 | 15:3.1.0-5.el7 | ELSA-2019-4713 |
Advisories 3
- openSUSE-SU-2024:11287-1 qemu-6.1.0-32.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2024-2028 QEMU: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 2, 2024
- ELSA-2019-4713 Important: qemu security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 10, 2019
References
- [qemu-devel] 20170216 [PATCH 2/5] NetRxPkt: Fix memory corruption on VLAN header stripping mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1423358
- [oss-security] 20170217 CVE-2017-6058 Qemu: net: vmxnet3: OOB NetRxPkt::ehdr_buf access when doing vlan stripping mailing-list
- GLSA-201704-01 vendor-advisory
- 1037856 vdb-entry
- http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=df8bf7a7fe75eb5d5caffa55f5cd4292b757aea6
- 96277 vdb-entry