Published: 07/11/2014 Updated: 13/02/2023

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P

The sosendto function in slirp/udp.c in QEMU prior to 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 7.0
qemu qemu 2.0.0
qemu qemu 2.0.2
qemu qemu 2.1.0
qemu qemu 2.1.1
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux hpc node 7.0
canonical ubuntu linux 12.04
canonical ubuntu linux 14.10
canonical ubuntu linux 14.04
canonical ubuntu linux 10.04

Debian Bug report logs - #762532 CVE-2014-3640: qemu: slirp: NULL pointer deref in sosendto() Package: qemu; Maintainer for qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Source for qemu is src:qemu (PTS, buildd, popcon) Reported by: Henri Salo <henri@nervfi> Date: Tue, 23 Sep 2014 06:57:12 UTC ...

Several security issues were fixed in QEMU ...

Several vulnerabilities were discovered in qemu, a fast processor emulator: Various security issues have been found in the block qemu drivers Malformed disk images might result in the execution of arbitrary code A NULL pointer dereference in SLIRP may result in denial of service An information leak was discovered in the VGA emulation For t ...

A NULL pointer dereference flaw was found in the way QEMU handled UDP packets with a source port and address of 0 when QEMU's user networking was in use A local guest user could use this flaw to crash the guest ...

CWE-476 https://bugzilla.redhat.com/show_bug.cgi?id=1144818 http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04707.html http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg03543.html http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04598.html http://www.debian.org/security/2014/dsa-3045 http://www.ubuntu.com/usn/USN-2409-1 http://rhn.redhat.com/errata/RHSA-2015-0349.html http://rhn.redhat.com/errata/RHSA-2015-0624.html http://www.debian.org/security/2014/dsa-3044 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=762532 https://usn.ubuntu.com/2409-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2014-3640

CVE-2014-3640

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect