CVE-2016-1981

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2016-2585.htmlThird Party Advisory
http://www.debian.org/security/2016/dsa-3469Third Party Advisory
http://www.debian.org/security/2016/dsa-3470Third Party Advisory
http://www.debian.org/security/2016/dsa-3471Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/01/19/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/01/22/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/81549Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1298570Issue Tracking
https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg03454.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201604-01Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2585.htmlThird Party Advisory
http://www.debian.org/security/2016/dsa-3469Third Party Advisory
http://www.debian.org/security/2016/dsa-3470Third Party Advisory
http://www.debian.org/security/2016/dsa-3471Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/01/19/10Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/01/22/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/81549Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1298570Issue Tracking
https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg03454.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201604-01Third Party Advisory

Timeline

Published: Dec 29, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-19827.5The remove_chunked_transfer_coding function in filters.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service (inva CVE-2016-19837.5The client_host function in parsers.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service (invalid read and crash)CVE-2016-19849.8The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2016-01-20 has a hardcoded password for the 1MB@tMaN account, wh CVE-2016-198510.0HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, re CVE-2016-19869.8HP Continuous Delivery Automation (CDA) 1.30 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, rel CVE-2016-19875.9HPE IPFilter A.11.31.18.21 on HP-UX, when a certain keep-state configuration is enabled, allows remote attackers to cause a denial of servic CVE-2016-19889.8HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive i CVE-2016-19899.8HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive i CVE-2016-19907.8HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows local CVE-2016-19918.0HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows remot CVE-2016-19926.5HPE ArcSight ESM before 6.8c, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to obtain sensitive information via u CVE-2016-19938.1HPE System Management Homepage before 7.5.4 allows remote authenticated users to obtain sensitive information or modify data via unspecified