CVE-2020-25707
Public on 2020-12-14
Modified on 2021-06-22
Description
An infinite loop flaw was found in the e1000e NIC emulation code of QEMU. This issue occurs in the e1000e_write_packet_to_guest() routine while processing bogus RX descriptor data transmitted by the guest. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
Severity
CVSS v3 Base Score
See breakdown
Affected Packages
Platform | Package | Release Date | Advisory | Status |
---|---|---|---|---|
Amazon Linux 2 - Core | qemu | 2021-06-16 | ALAS2-2021-1671 | Fixed |
CVSS Scores
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv3 | 2.5 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L |