CVE-2016-2392

The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor…

published June 16, 2016

CVSS
—
EPSS
0%
Percentile
34.6
In the wild
Unconfirmed
What it is

The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00416 · 34.6th percentile
Published
2016-06-16T18:00Z
EPSS history
Timeline
  • 16 JUN 18:00Z
    The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor…
    cvelistv5