VulnerabilityModified
CVE-2021-20257
This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service.
MEDIUM 6.5EPSS 0.37%
Does this matter?
Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.
Description
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- EPSS
- 0.37% probability · 30th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-835
- Affected
- qemu/qemu · fedoraproject/fedora · redhat/openstack platform · redhat/enterprise linux · redhat/enterprise linux for ibm z systems · redhat/enterprise linux for power little endian · redhat/codeready linux builder · debian/debian linux
- Source
- secalert@redhat.com
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1930087Issue Tracking, Patch, Third Party Advisory
- https://github.com/qemu/qemu/commit/3de46e6fc489c52c9431a8a832ad8170a7569bd8Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
- https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg07428.htmlMailing List, Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202208-27Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220425-0003/Third Party Advisory
- https://www.openwall.com/lists/oss-security/2021/02/25/2Mailing List, Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1930087Issue Tracking, Patch, Third Party Advisory
- https://github.com/qemu/qemu/commit/3de46e6fc489c52c9431a8a832ad8170a7569bd8Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
- https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg07428.htmlMailing List, Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202208-27Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220425-0003/Third Party Advisory
- https://www.openwall.com/lists/oss-security/2021/02/25/2Mailing List, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.