CVE-2020-25707

Public on 2020-12-14
Modified on 2021-06-22
Description
An infinite loop flaw was found in the e1000e NIC emulation code of QEMU. This issue occurs in the e1000e_write_packet_to_guest() routine while processing bogus RX descriptor data transmitted by the guest. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
Severity
Low severity
Low
CVSS v3 Base Score
2.5
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core qemu 2021-06-16 ALAS2-2021-1671 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 2.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L