The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit process IO loop to the ring size.
The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Qemu | Qemu | * | 2.7.1 (including) |
| Qemu | Ubuntu | devel | * |
| Qemu | Ubuntu | trusty | * |
| Qemu | Ubuntu | xenial | * |
| Qemu | Ubuntu | yakkety | * |