The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Debian_linux | Debian | 7.0 (including) | 7.0 (including) |
| Qemu | Ubuntu | devel | * |
| Qemu | Ubuntu | trusty | * |
| Qemu | Ubuntu | utopic | * |
| Qemu-kvm | Ubuntu | lucid | * |
| Qemu-kvm | Ubuntu | precise | * |
| Red Hat Enterprise Linux 7 | RedHat | qemu-kvm-10:1.5.3-86.el7 | * |
| RHEV 3.X Hypervisor and Agents for RHEL-7 | RedHat | qemu-kvm-rhev-10:2.1.2-23.el7 | * |