CVE-2016-2841

The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control.

CVSS v3.0 6.0 MEDIUM
CVSS v2.0 2.1 LOW

6.0^/10

CVSS v3.0 : MEDIUM

Vector : AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Exploitability : 1.5 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://www.ubuntu.com/usn/USN-2974-1
http://www.openwall.com/lists/oss-security/2016/03/02/8
https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg06126.html	Vendor Advisory
http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1303106
http://www.securityfocus.com/bid/84028
https://security.gentoo.org/glsa/201609-01
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=415ab35a441eca767d033a2702223e785b9d5190

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:15.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::

Information

Published : 2016-06-16 11:59

Updated : 2023-02-12 15:17

NVD link : CVE-2016-2841

Mitre link : CVE-2016-2841

JSON object : View

CWE

CWE-20

Improper Input Validation

Advertisement

Products Affected

canonical

ubuntu_linux

qemu

qemu

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.ubuntu.com/usn/USN-2974-1", "name": "USN-2974-1", "tags": [], "refsource": "UBUNTU"}, {"url": "http://www.openwall.com/lists/oss-security/2016/03/02/8", "name": "[oss-security] 20160302 CVE request Qemu: net: ne2000: infinite loop in ne2000_receive", "tags": [], "refsource": "MLIST"}, {"url": "https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg06126.html", "name": "[qemu-devel] 20160226 Re: [PATCH v2] net: ne2000: check ring buffer control registers", "tags": ["Vendor Advisory"], "refsource": "MLIST"}, {"url": "http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html", "name": "[qemu-stable] 20160329 [Qemu-stable] [ANNOUNCE] QEMU 2.5.1 Stable released", "tags": ["Vendor Advisory"], "refsource": "MLIST"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1303106", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1303106", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/84028", "name": "84028", "tags": [], "refsource": "BID"}, {"url": "https://security.gentoo.org/glsa/201609-01", "name": "GLSA-201609-01", "tags": [], "refsource": "GENTOO"}, {"url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html", "name": "[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update", "tags": [], "refsource": "MLIST"}, {"url": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=415ab35a441eca767d033a2702223e785b9d5190", "name": "http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=415ab35a441eca767d033a2702223e785b9d5190", "tags": [], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via crafted values for the PSTART and PSTOP registers, involving ring buffer control."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-20"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2016-2841", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "severity": "LOW", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 1.5}}, "publishedDate": "2016-06-16T18:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.5.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-02-12T23:17Z"}