Debian 9: DLA-2623-1 Critical: QEMU Denial Of Service Report

net: e1000: infinite loop while processing transmit descriptors


CVE-2021-20255

A stack overflow via an infinite recursion vulnerability was found in the
eepro100 i8255x device emulator of QEMU. This issue occurs while processing
controller commands due to a DMA reentry issue. This flaw allows a guest
user or process to consume CPU cycles or crash the QEMU process on the
host, resulting in a denial of service.

CVE-2021-20203

An integer overflow issue was found in the vmxnet3 NIC emulator of the
QEMU. It may occur if a guest was to supply invalid values for rx/tx queue
size or other NIC parameters. A privileged guest user may use this flaw to
crash the QEMU process on the host resulting in DoS scenario.

CVE-2021-3416

A potential stack overflow via infinite loop issue was found in various NIC
emulators of QEMU in versions up to and including 5.2.0. The issue occurs
in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A