Jason Wang

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the virtio-net component in the Linux kernel, where pages leak when building skb in big mode. This happens because the code tries to use build skb() when there is sufficient tailroom, but it forgets to release the unused pages chained via private in big mode, resulting in page leaks. The fix involves releasing the pages after building the skb in big mode. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the virtqueue doorbell mapping in the Linux kernel. The virtqueue doorbell is usually implemented via registers, but the necessary vma->flags like VM PFNMAP are not provided. This may cause several issues, such as a kernel panic, when userspace tries to map the doorbell via vhost IOTLB. The patch fixes this by setting the necessary vm flags, causing attempts to map the doorbell via IOTLB to fail with a bad address. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU version 4.2.0 **Description** The issue is related to a buffer overflow in the hw/net/tulip.c component of the QEMU hardware emulator. This occurs during the copying of tx/rx buffers because the frame size is not validated against the r/w data length. Exploitation of this issue could allow a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. **Recommendations** For QEMU version 4.2.0, as a temporary workaround, consider disabling the `hw/net/tulip.c` component until a patch is available. Restrict access to the vulnerable `tx/rx` buffers to minimize the risk of exploitation. Avoid using the `hw/net/tulip.c` component in the affected QEMU version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions from v4.16 and newer **Description** A flaw in the Linux kernel's handle rx() function in the vhost net driver can be exploited by a malicious virtual guest to trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host. This may lead to kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. **Recommendations** For Linux kernel versions from v4.16 and newer, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** The issue is related to a buffer overflow in the `pcnet receive` function, which can be triggered when a guest NIC has a larger MTU, allowing remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.2 **Description** The issue is related to the virtnet probe function in the Linux kernel, which fails to properly allocate memory when supporting the FRAGLIST feature. This allows guest OS users to cause a denial of service by sending a crafted sequence of fragmented packets, resulting in a buffer overflow and memory corruption. **Recommendations** For Linux kernel versions prior to 4.2, update to version 4.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** qemu versions 1.3.0 and later **Description** A flaw was found in the way qemu validates addresses when a guest accesses the config space of a virtio device. If the virtio device has zero or small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host. **Recommendations** For qemu versions 1.3.0 and later, update to a version that fixes this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 3.13 **Description** The issue allows remote attackers to cause a denial of service, resulting in an infinite loop. This can be achieved by sending a packet with IPIP encapsulation that contains a small value in the IHL field. **Recommendations** For Linux kernel versions prior to 3.13, update to version 3.13 or later to resolve the issue.