Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 560760 (CVE-2015-7295) - <app-emulation/qemu-2.4.0-r2: DoS in Virtual Network Device (virtio-net) (CVE-2015-7295)
Summary: <app-emulation/qemu-2.4.0-r2: DoS in Virtual Network Device (virtio-net) (CVE...
Alias: CVE-2015-7295
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B3 [glsa cve]
Depends on:
Reported: 2015-09-18 11:02 UTC by Kristian Fiskerstrand (RETIRED)
Modified: 2016-02-04 09:34 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Kristian Fiskerstrand (RETIRED) gentoo-dev 2015-09-18 11:02:08 UTC
From ${URL}:

Qemu emulator built with the Virtual Network Device(virtio-net) support is vulnerable to a DoS issue. It could occur while receiving large packets over the tuntap/macvtap interfaces and when guest's virtio-net driver did not support big/mergeable receive buffers.

An attacker on the local network could use this flaw to disable guest's
networking by sending a large number of jumbo frames to the guest, exhausting
all receive buffers and thus leading to a DoS situation.

Upstream fixes:

[PATCH 3/3] above fixes this issue by discarding the used descriptors.

Thank you.
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
Comment 2 SpanKY gentoo-dev 2015-10-10 01:00:00 UTC
qemu- in the tree should have the fixes for this and should be fine to mark stable
Comment 3 Yury German Gentoo Infrastructure gentoo-dev 2015-11-03 17:31:23 UTC
We now have  do you want to go with that as stable? or with
Comment 4 Kristian Fiskerstrand (RETIRED) gentoo-dev 2015-11-11 10:00:19 UTC
Also 2.4.1 is now in tree

@maintainers: Can you please advise on which version to stabilize?

commit 8ba1e580c6566005cfe98625e52b94803f367528
Author: Mike Frysinger <>
Date:   Fri Nov 6 11:36:45 2015 -0500

    app-emulation/qemu: version bump to 2.4.1 #564990

Comment 5 Agostino Sarubbo gentoo-dev 2015-12-18 17:10:29 UTC
stabilized in another bug.

cleanup done by vapier
Comment 6 Yury German Gentoo Infrastructure gentoo-dev 2015-12-25 00:34:48 UTC
Arches and Maintainer(s), Thank you for your work.

Added to an existing GLSA Request.
Comment 7 GLSAMaker/CVETool Bot gentoo-dev 2016-02-04 09:34:07 UTC
This issue was resolved and addressed in
 GLSA 201602-01 at
by GLSA coordinator Kristian Fiskerstrand (K_F).