CVE-2012-6075

qemu: e1000 driver buffer overflow when processing large packets when SBP and LPE flags are disabled

Severity Score

9.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet.

Desbordamiento de buffer en la función e1000_receive del controlador de dispositivo e1000 (hw/e1000.c) en QEMU v1.3.0-rc2 y otras versiones, cuando las banderas de PAS y LPE están deshabilitadas, permiten ataques remotos que provocan una denegación de servicios (errores en el sistema operativo invitado) y posiblemente ejecutar código arbitrario.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

Attack Vector

Adjacent

Attack Complexity

High

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2012-12-06 CVE Reserved
2013-01-15 CVE Published
2024-08-06 CVE Updated
2024-09-13 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CAPEC

References (23)

URL	Tag	Source
http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=b0d9ffcd0251161c7c92f94804dcf599dfa3edeb	X_refsource_confirm
http://secunia.com/advisories/55082	Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/12/30/1	Mailing List
http://www.securityfocus.com/bid/57420	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
http://lists.nongnu.org/archive/html/qemu-devel/2012-12/msg00533.html	2023-02-13

URL	Date	SRC
http://lists.fedoraproject.org/pipermail/package-announce/2013-January/097541.html	2023-02-13
http://lists.fedoraproject.org/pipermail/package-announce/2013-January/097575.html	2023-02-13
http://lists.fedoraproject.org/pipermail/package-announce/2013-January/097705.html	2023-02-13
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html	2023-02-13
http://lists.opensuse.org/opensuse-updates/2013-04/msg00051.html	2023-02-13
http://lists.opensuse.org/opensuse-updates/2013-04/msg00052.html	2023-02-13
http://rhn.redhat.com/errata/RHSA-2013-0599.html	2023-02-13
http://rhn.redhat.com/errata/RHSA-2013-0608.html	2023-02-13
http://rhn.redhat.com/errata/RHSA-2013-0609.html	2023-02-13
http://rhn.redhat.com/errata/RHSA-2013-0610.html	2023-02-13
http://rhn.redhat.com/errata/RHSA-2013-0639.html	2023-02-13
http://security.gentoo.org/glsa/glsa-201309-24.xml	2023-02-13
http://www.debian.org/security/2013/dsa-2607	2023-02-13
http://www.debian.org/security/2013/dsa-2608	2023-02-13
http://www.debian.org/security/2013/dsa-2619	2023-02-13
http://www.ubuntu.com/usn/USN-1692-1	2023-02-13
https://bugzilla.redhat.com/show_bug.cgi?id=889301	2013-03-12
https://access.redhat.com/security/cve/CVE-2012-6075	2013-03-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"	Virtualization Search vendor "Redhat" for product "Virtualization"	3.0 Search vendor "Redhat" for product "Virtualization" and version "3.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	6.0 Search vendor "Redhat" for product "Enterprise Linux" and version "6.0"	-	Safe
Qemu Search vendor "Qemu"		Qemu Search vendor "Qemu" for product "Qemu"				< 1.3.0 Search vendor "Qemu" for product "Qemu" and version " < 1.3.0"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				16 Search vendor "Fedoraproject" for product "Fedora" and version "16"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				17 Search vendor "Fedoraproject" for product "Fedora" and version "17"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				18 Search vendor "Fedoraproject" for product "Fedora" and version "18"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				12.1 Search vendor "Opensuse" for product "Opensuse" and version "12.1"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				12.2 Search vendor "Opensuse" for product "Opensuse" and version "12.2"		-		Affected
Suse Search vendor "Suse"		Linux Enterprise Server Search vendor "Suse" for product "Linux Enterprise Server"				11 Search vendor "Suse" for product "Linux Enterprise Server" and version "11"		sp1, ltss		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop"				5.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "5.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop"				6.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "6.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Eus Search vendor "Redhat" for product "Enterprise Linux Eus"				5.9 Search vendor "Redhat" for product "Enterprise Linux Eus" and version "5.9"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Eus Search vendor "Redhat" for product "Enterprise Linux Eus"				6.4 Search vendor "Redhat" for product "Enterprise Linux Eus" and version "6.4"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"				5.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "5.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"				6.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "6.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Aus Search vendor "Redhat" for product "Enterprise Linux Server Aus"				5.9 Search vendor "Redhat" for product "Enterprise Linux Server Aus" and version "5.9"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Aus Search vendor "Redhat" for product "Enterprise Linux Server Aus"				6.4 Search vendor "Redhat" for product "Enterprise Linux Server Aus" and version "6.4"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation"				5.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "5.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation"				6.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "6.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				6.0 Search vendor "Debian" for product "Debian Linux" and version "6.0"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				10.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "10.04"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				11.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "11.10"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04"		esm		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				12.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.10"		-		Affected