PT-2015-2670 · Qemu+3 · Qemu+3

Prasad J Pandit · Published 2015-10-13 · Updated 2020-09-09 · CVE-2015-7295

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions QEMU (affected versions not specified)

Description The issue is related to the Virtual Network Device (virtio-net) support in QEMU, specifically in the hw/virtio/virtio.c module. When big or mergeable receive buffers are not supported, remote attackers can cause a denial of service by flooding the network with jumbo frames on the tuntap or macvtap interface. This can lead to guest network consumption. The problem is caused by a buffer overflow in the virtio.c module.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2015-2158

BDU:2015-12035

CVE-2015-7295

DSA-3469-1

DSA-3470-1

DSA-3471-1

MGASA-2015-0397

SUSE-SU-2016:1560-1

SUSE-SU-2016:1698-1

SUSE-SU-2016:1785-1

USN-2828-1

Affected Products

Alt Linux

Qemu

Suse

Ubuntu

References · 159

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8619 · Security Note
• https://osv.dev/vulnerability/DSA-3470-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201602-01 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-7512 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-7295 · Vendor Advisory
• http://debian.org/security/2016/dsa-3471 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169767.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8743 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1568 · Security Note
• https://errata.altlinux.org/ALT-PU-2015-2158 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8567 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8666 · Security Note
• https://ubuntu.com/security/CVE-2015-8345 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8550 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7504 · Security Note