CVE-2020-16092

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 5.0.0

Description The issue is related to an assertion failure in the network packet processing, affecting the e1000e and vmxnet3 network devices. A malicious guest user or process could exploit this flaw to abort the QEMU process on the host, resulting in a denial of service condition. This occurs in the net tx pkt add raw fragment function in hw/net/net tx pkt.c.

Recommendations For QEMU versions prior to 5.0.0, update to version 5.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the net tx pkt add raw fragment function in hw/net/net tx pkt.c to minimize the risk of exploitation.