Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes.
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2016-4002 from the MITRE CVE dictionary dictionary and NIST NVD.
This has been rated as having Moderate security impact and is not currently
planned to be addressed in future updates. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/.
NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.
| Base Score | 4.3 |
|---|---|
| Base Metrics | AV:A/AC:M/Au:N/C:N/I:P/A:P |
| Access Vector | Adjacent Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | None |
| Integrity Impact | Partial |
| Availability Impact | Partial |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
| Platform | Package | State |
|---|---|---|
| Red Hat OpenStack Platform 8.0 (Liberty) | qemu-kvm-rhev | Not affected |
| Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 | qemu-kvm-rhev | Not affected |
| Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 | qemu-kvm-rhev | Not affected |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) | qemu-kvm-rhev | Not affected |
| Red Hat Enterprise Linux 7 | qemu-kvm-rhev | Not affected |
| Red Hat Enterprise Linux 7 | qemu-kvm | Will not fix |
| Red Hat Enterprise Linux 6 | qemu-kvm | Will not fix |
| Red Hat Enterprise Linux 5 | kvm | Will not fix |
| Red Hat Enterprise Linux 5 | xen | Not affected |
Vulmon