CVE-2016-4001

high-risk
Published 2016-05-23

Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configured to accept large packets, allows remote attackers to cause a denial of service (QEMU crash) via a large packet.

Do I need to act?

~
9.4% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.6/10 High
NETWORK / LOW complexity

Affected Products (11)

Affected Vendors

Qemu Canonical Debian Fedoraproject

References (22)

http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3a15cc0e1ee7168db0782133d2607a6bf...
Third Party Advisory http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183275.html
Third Party Advisory http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183350.html
Third Party Advisory http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184209.html
Mailing List http://www.openwall.com/lists/oss-security/2016/04/11/4
Mailing List http://www.openwall.com/lists/oss-security/2016/04/12/6
Third Party Advisory http://www.securityfocus.com/bid/85976
Third Party Advisory http://www.ubuntu.com/usn/USN-2974-1
Mailing List https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
Patch https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01334.html
Third Party Advisory https://security.gentoo.org/glsa/201609-01
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3a15cc0e1ee7168db0782133d2607a6bf...
Third Party Advisory http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183275.html
Third Party Advisory http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183350.html
Third Party Advisory http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184209.html
Mailing List http://www.openwall.com/lists/oss-security/2016/04/11/4
Mailing List http://www.openwall.com/lists/oss-security/2016/04/12/6
Third Party Advisory http://www.securityfocus.com/bid/85976
Third Party Advisory http://www.ubuntu.com/usn/USN-2974-1
Mailing List https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
and 2 more references
56
/ 100
high-risk
Severity 29/34 · Critical
Exploitability 11/34 · Low
Exposure 16/34 · Moderate