CVE-2021-20257
Medium
Description
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Qemu
PublishedMar 16, 2022
First seenMar 16, 2022
Weakness typeCWE-835CWE-835
How to fix
Update
- qemu qemu6.2.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qemu qemu | v < 6.2.0 | 6.2.0 |
| fedoraproject fedora | 33 | — |
| redhat openstack_platform | 10.0, 13.0 | — |
| redhat enterprise_linux | 6.0, 8.0 | — |
| redhat enterprise_linux_for_ibm_z_systems | 8.0 | — |
| redhat enterprise_linux_for_power_little_endian | 8.0 | — |
| redhat codeready_linux_builder | No range specified | — |
| debian debian_linux | 10.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.