Infinite loop in QEMU - CVE-2021-20257

Vulnerability identifier: #VU59085

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-20257

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in the e1000 NIC emulator when processing transmits (tx) descriptors in process_tx_desc of QEMU. A remote user can consume all available CPU resources and cause denial of service conditions.

QEMU
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Anolis OS
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Server
openEuler
Red Hat Enterprise Linux Advanced Virtualization
netcf-libs
netcf-devel
netcf
sgabios-bin
sgabios
libnbd
libnbd-devel
python3-libnbd
nbdfuse
libvirt-dbus
ocaml-hivex
hivex
hivex-devel
ruby-hivex
python3-hivex
perl-hivex
ocaml-hivex-devel
seabios-bin
seavgabios-bin
seabios
nbdkit-server
nbdkit-ssh-plugin
nbdkit
nbdkit-basic-filters
nbdkit-basic-plugins
nbdkit-curl-plugin
nbdkit-devel
nbdkit-vddk-plugin
nbdkit-xz-filter
nbdkit-example-plugins
nbdkit-gzip-plugin
nbdkit-linuxdisk-plugin
nbdkit-python-plugin
nbdkit-bash-completion
libguestfs-inspect-icons
ocaml-libguestfs-devel
perl-Sys-Guestfs
ocaml-libguestfs
python3-libguestfs
lua-guestfs
libguestfs-bash-completion
ruby-libguestfs
virt-dib
libguestfs-javadoc
libguestfs-man-pages-ja
libguestfs-man-pages-uk
libguestfs-tools
virt-v2v
libguestfs
libguestfs-benchmarking
libguestfs-devel
libguestfs-gfs2
libguestfs-gobject
libguestfs-gobject-devel
libguestfs-java-devel
libguestfs-xfs
libguestfs-tools-c
libguestfs-rsync
libguestfs-rescue
libguestfs-java
qemu-guest-agent
qemu-img
qemu-block-iscsi
qemu-block-curl
qemu-block-ssh
qemu-debuginfo
qemu-help
qemu-block-rbd
qemu-seabios
qemu-debugsource
qemu
qemu-kvm
qemu-kvm-block-curl
qemu-kvm-block-iscsi
qemu-kvm-block-rbd
qemu-kvm-block-ssh
qemu-kvm-common
qemu-kvm-core
qemu-kvm-tests
qemu-kvm-block-gluster
xen-kmp-default
xen-kmp-pae
xen-libs
xen-debuginfo
xen-tools
xen-libs-32bit
xen-doc-html
xen
xen-debugsource
xen-tools-domU
xen-tools-domU-debuginfo
xen-tools-debuginfo
xen-libs-debuginfo
xen-libs-debuginfo-32bit
supermin
supermin-devel
perl-Sys-Virt
python3-libvirt
libvirt-daemon-driver-interface
libvirt-daemon-config-nwfilter
libvirt-daemon-config-network
libvirt-daemon
libvirt-client
libvirt-bash-completion
libvirt-admin
libvirt
libvirt-daemon-driver-network
libvirt-daemon-driver-nodedev
libvirt-lock-sanlock
libvirt-libs
libvirt-docs
libvirt-devel
libvirt-daemon-kvm
libvirt-daemon-driver-storage-scsi
libvirt-daemon-driver-storage-rbd
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-storage
libvirt-daemon-driver-secret
libvirt-daemon-driver-qemu
libvirt-daemon-driver-nwfilter
libvirt-nss
libguestfs-winsupport

Install updates from vendor's website.

netcf-libs - update to 0.2.8-12
netcf-devel - update to 0.2.8-12
netcf - update to 0.2.8-12
sgabios-bin - update to 0.20170427git-3
sgabios - update to 0.20170427git-3
libnbd - update to 1.2.2-1.0.1
libnbd-devel - update to 1.2.2-1.0.1
python3-libnbd - update to 1.2.2-1.0.1
nbdfuse - update to 1.2.2-1.0.1
libvirt-dbus - update to 1.3.0-2
ocaml-hivex - update to 1.3.18-21
hivex - update to 1.3.18-21
hivex-devel - update to 1.3.18-21
ruby-hivex - update to 1.3.18-21
python3-hivex - update to 1.3.18-21
perl-hivex - update to 1.3.18-21
ocaml-hivex-devel - update to 1.3.18-21
seabios-bin - update to 1.13.0-2
seavgabios-bin - update to 1.13.0-2
seabios - update to 1.13.0-2
nbdkit-server - update to 1.16.2-4
nbdkit-ssh-plugin - update to 1.16.2-4
nbdkit - update to 1.16.2-4
nbdkit-basic-filters - update to 1.16.2-4
nbdkit-basic-plugins - update to 1.16.2-4
nbdkit-curl-plugin - update to 1.16.2-4
nbdkit-devel - update to 1.16.2-4
nbdkit-vddk-plugin - update to 1.16.2-4
nbdkit-xz-filter - update to 1.16.2-4
nbdkit-example-plugins - update to 1.16.2-4
nbdkit-gzip-plugin - update to 1.16.2-4
nbdkit-linuxdisk-plugin - update to 1.16.2-4
nbdkit-python-plugin - update to 1.16.2-4
nbdkit-bash-completion - update to 1.16.2-4
libguestfs-inspect-icons - update to 1.40.2-28.0.1
ocaml-libguestfs-devel - update to 1.40.2-28.0.1
perl-Sys-Guestfs - update to 1.40.2-28.0.1
ocaml-libguestfs - update to 1.40.2-28.0.1
python3-libguestfs - update to 1.40.2-28.0.1
lua-guestfs - update to 1.40.2-28.0.1
libguestfs-bash-completion - update to 1.40.2-28.0.1
ruby-libguestfs - update to 1.40.2-28.0.1
virt-dib - update to 1.40.2-28.0.1
libguestfs-javadoc - update to 1.40.2-28.0.1
libguestfs-man-pages-ja - update to 1.40.2-28.0.1
libguestfs-man-pages-uk - update to 1.40.2-28.0.1
libguestfs-tools - update to 1.40.2-28.0.1
virt-v2v - update to 1.40.2-28.0.1
libguestfs - update to 1.40.2-28.0.1
libguestfs-benchmarking - update to 1.40.2-28.0.1
libguestfs-devel - update to 1.40.2-28.0.1
libguestfs-gfs2 - update to 1.40.2-28.0.1
libguestfs-gobject - update to 1.40.2-28.0.1
libguestfs-gobject-devel - update to 1.40.2-28.0.1
libguestfs-java-devel - update to 1.40.2-28.0.1
libguestfs-xfs - update to 1.40.2-28.0.1
libguestfs-tools-c - update to 1.40.2-28.0.1
libguestfs-rsync - update to 1.40.2-28.0.1
libguestfs-rescue - update to 1.40.2-28.0.1
libguestfs-java - update to 1.40.2-28.0.1
qemu-guest-agent - update to 4.1.0-65
qemu-img - update to 4.1.0-65
qemu-block-iscsi - update to 4.1.0-65
qemu-block-curl - update to 4.1.0-65
qemu-block-ssh - update to 4.1.0-65
qemu-debuginfo - update to 4.1.0-65
qemu-help - update to 4.1.0-65
qemu-block-rbd - update to 4.1.0-65
qemu-seabios - update to 4.1.0-65
qemu-debugsource - update to 4.1.0-65
qemu - update to 4.1.0-65
qemu-kvm - update to 4.2.0-59.0.2
qemu-guest-agent - update to 4.2.0-59.0.2
qemu-img - update to 4.2.0-59.0.2
qemu-kvm-block-curl - update to 4.2.0-59.0.2
qemu-kvm-block-iscsi - update to 4.2.0-59.0.2
qemu-kvm-block-rbd - update to 4.2.0-59.0.2
qemu-kvm-block-ssh - update to 4.2.0-59.0.2
qemu-kvm-common - update to 4.2.0-59.0.2
qemu-kvm-core - update to 4.2.0-59.0.2
qemu-kvm-tests - update to 4.2.0-59.0.2
qemu-kvm-block-gluster - update to 4.2.0-59.0.2
xen-kmp-default - update to 4.4.4_48_3.0.101_108.123-61.64.1
xen-kmp-pae - update to 4.4.4_48_3.0.101_108.123-61.64.1
xen-libs - addressed in versions 4.4.4_48-61.64.1, 4.7.6_22-43.88.1
xen-debuginfo - update to 4.4.4_48-61.64.1
xen-tools - addressed in versions 4.4.4_48-61.64.1, 4.7.6_22-43.88.1
xen-libs-32bit - addressed in versions 4.4.4_48-61.64.1, 4.7.6_22-43.88.1
xen-doc-html - addressed in versions 4.4.4_48-61.64.1, 4.7.6_22-43.88.1
xen - addressed in versions 4.4.4_48-61.64.1, 4.7.6_22-43.88.1
xen-debugsource - addressed in versions 4.4.4_48-61.64.1, 4.7.6_22-43.88.1
xen-tools-domU - addressed in versions 4.4.4_48-61.64.1, 4.7.6_22-43.88.1
xen-tools-domU-debuginfo - update to 4.7.6_22-43.88.1
xen-tools-debuginfo - update to 4.7.6_22-43.88.1
xen-libs-debuginfo - update to 4.7.6_22-43.88.1
xen-libs-debuginfo-32bit - update to 4.7.6_22-43.88.1
supermin - update to 5.1.19-10
supermin-devel - update to 5.1.19-10
perl-Sys-Virt - update to 6.0.0-1
python3-libvirt - update to 6.0.0-1
libvirt-daemon-driver-interface - update to 6.0.0-37.1.0.1
libvirt-daemon-config-nwfilter - update to 6.0.0-37.1.0.1
libvirt-daemon-config-network - update to 6.0.0-37.1.0.1
libvirt-daemon - update to 6.0.0-37.1.0.1
libvirt-client - update to 6.0.0-37.1.0.1
libvirt-bash-completion - update to 6.0.0-37.1.0.1
libvirt-admin - update to 6.0.0-37.1.0.1
libvirt - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-network - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-nodedev - update to 6.0.0-37.1.0.1
libvirt-lock-sanlock - update to 6.0.0-37.1.0.1
libvirt-libs - update to 6.0.0-37.1.0.1
libvirt-docs - update to 6.0.0-37.1.0.1
libvirt-devel - update to 6.0.0-37.1.0.1
libvirt-daemon-kvm - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-scsi - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-rbd - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-mpath - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-logical - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-iscsi-direct - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-iscsi - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-gluster - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-disk - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-core - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-secret - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-qemu - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-nwfilter - update to 6.0.0-37.1.0.1
libvirt-nss - update to 6.0.0-37.1.0.1
libguestfs-winsupport - update to 8.2-1

• https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg03595.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1930087

• Denial of service in QEMU
• Red Hat Enterprise Linux 8 update for the virt:rhel and virt-devel:rhel modules
• Red Hat Enterprise Linux Advanced Virtualization 8 update for the virt:av and virt-devel:av modules
• SUSE update for xen
• openEuler update for qemu
• SUSE update for xen
• Anolis OS update for virt:an module