Qemu emulator built with the Virtual Network Device(virtio-net) support is vulnerable to a DoS issue. It could occur while receiving large packets over the tuntap/macvtap interfaces and when guest's virtio-net driver did not support big/mergeable receive buffers.
An attacker on the local network could use this flaw to disable guest's
networking by sending a large number of jumbo frames to the guest, exhausting
all receive buffers and thus leading to a DoS situation.
[PATCH 3/3] above fixes this issue by discarding the used descriptors.
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
qemu-220.127.116.11 in the tree should have the fixes for this and should be fine to mark stable
We now have 18.104.22.168-r1 do you want to go with that as stable? or with 22.214.171.124
Also 2.4.1 is now in tree
@maintainers: Can you please advise on which version to stabilize?
Author: Mike Frysinger <firstname.lastname@example.org>
Date: Fri Nov 6 11:36:45 2015 -0500
app-emulation/qemu: version bump to 2.4.1 #564990
stabilized in another bug.
cleanup done by vapier
Arches and Maintainer(s), Thank you for your work.
Added to an existing GLSA Request.
This issue was resolved and addressed in
GLSA 201602-01 at https://security.gentoo.org/glsa/201602-01
by GLSA coordinator Kristian Fiskerstrand (K_F).