Skip to content
Heist/ feed
Back to feed
Medium

Security advisory

Type: advisorySources: OSVCVE: CVE-2016-1981

QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2016-1981
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 06:00 UTC · Revision 1

Source evidence

CVE-2016-1981

core-osv · Original source

Published 29 Dec 2016, 22:59 UTC

QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.

osv:CVE-2016-1981
Complete source record
{
  "id": "ced15a6c0c10c5fe0489292c0e77b3b11de6b5164e0dbd72c773bbad315d44d8",
  "url": "https://osv.dev/vulnerability/CVE-2016-1981",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2016-1981",
    "summary": "QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.",
    "evidence": "osv:CVE-2016-1981",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2016-1981",
      "aliases": [
        "CVE-2016-1981"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/qemu/qemu",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "db51dfc1fcaf0027a5f266b7def4317605848c6a"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "2.5.1.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.5.1.1",
            "v2.5.1",
            "v2.5.0",
            "v2.5.0-rc4",
            "v2.5.0-rc3",
            "v2.5.0-rc2",
            "v2.5.0-rc1",
            "v2.5.0-rc0",
            "v2.4.0",
            "v2.4.0-rc4",
            "v2.4.0-rc3",
            "v2.3.0",
            "v2.4.0-rc2",
            "v2.4.0-rc1",
            "v2.4.0-rc0",
            "v2.3.0-rc4",
            "v2.3.0-rc3",
            "v2.3.0-rc2",
            "v2.3.0-rc1",
            "v2.3.0-rc0",
            "v2.2.0",
            "v2.2.0-rc3",
            "v2.2.0-rc5",
            "v2.2.0-rc4",
            "v2.2.0-rc2",
            "v2.2.0-rc1",
            "v2.2.0-rc0",
            "v2.1.0",
            "v2.1.0-rc5",
            "v2.1.0-rc4",
            "v2.1.0-rc2",
            "v2.1.0-rc3",
            "v2.0.0",
            "v2.1.0-rc1",
            "v2.1.0-rc0",
            "v2.0.0-rc3",
            "v2.0.0-rc2",
            "v2.0.0-rc1",
            "v2.0.0-rc0",
            "v1.7.0",
            "v1.7.0-rc2",
            "v1.7.0-rc1",
            "v1.7.0-rc0",
            "v1.6.0",
            "v1.6.0-rc3",
            "v1.6.0-rc2",
            "v1.6.0-rc1",
            "v1.6.0-rc0",
            "v1.5.0",
            "v1.5.0-rc3",
            "v1.5.0-rc2",
            "v1.5.0-rc1",
            "v1.5.0-rc0",
            "v1.4.0",
            "v1.4.0-rc2",
            "v1.4.0-rc1",
            "v1.4.0-rc0",
            "v1.3.0",
            "v1.3.0-rc2",
            "v1.3.0-rc1",
            "v1.3.0-rc0",
            "v1.2.0",
            "v1.2.0-rc3",
            "v1.2.0-rc2",
            "v1.2.0-rc1",
            "v1.2.0-rc0",
            "v1.1.0",
            "v1.1.0-rc4",
            "v1.1.0-rc3",
            "v1.1.0-rc2",
            "v1.1-rc2",
            "v1.1-rc1",
            "v1.1-rc0",
            "v1.0",
            "v1.0-rc4",
            "v1.0-rc3",
            "v1.0-rc2",
            "v1.0-rc1",
            "v1.0-rc0",
            "v0.14.0-rc0",
            "v0.13.0-rc0",
            "v0.12.0-rc0",
            "v0.11.0-rc0",
            "v0.5.0",
            "v0.4.4",
            "v0.4.3",
            "v0.4.2",
            "v0.4.1",
            "v0.4.0",
            "v0.3.0",
            "v0.2.0",
            "v0.1.6",
            "v0.1.5",
            "v0.1.4",
            "v0.1.3",
            "v0.1.1",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1981.json"
          }
        },
        {
          "ranges": [
            {
              "repo": "https://gitlab.com/qemu-project/qemu",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "db51dfc1fcaf0027a5f266b7def4317605848c6a"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "2.5.1.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.5.1.1",
            "v2.5.1",
            "v2.5.0",
            "v2.5.0-rc4",
            "v2.5.0-rc3",
            "v2.5.0-rc2",
            "v2.5.0-rc1",
            "v2.5.0-rc0",
            "v2.4.0",
            "v2.4.0-rc4",
            "v2.4.0-rc3",
            "v2.3.0",
            "v2.4.0-rc2",
            "v2.4.0-rc1",
            "v2.4.0-rc0",
            "v2.3.0-rc4",
            "v2.3.0-rc3",
            "v2.3.0-rc2",
            "v2.3.0-rc1",
            "v2.3.0-rc0",
            "v2.2.0",
            "v2.2.0-rc3",
            "v2.2.0-rc5",
            "v2.2.0-rc4",
            "v2.2.0-rc2",
            "v2.2.0-rc1",
            "v2.2.0-rc0",
            "v2.1.0",
            "v2.1.0-rc5",
            "v2.1.0-rc4",
            "v2.1.0-rc2",
            "v2.1.0-rc3",
            "v2.0.0",
            "v2.1.0-rc1",
            "v2.1.0-rc0",
            "v2.0.0-rc3",
            "v2.0.0-rc2",
            "v2.0.0-rc1",
            "v2.0.0-rc0",
            "v1.7.0",
            "v1.7.0-rc2",
            "v1.7.0-rc1",
            "v1.7.0-rc0",
            "v1.6.0",
            "v1.6.0-rc3",
            "v1.6.0-rc2",
            "v1.6.0-rc1",
            "v1.6.0-rc0",
            "v1.5.0",
            "v1.5.0-rc3",
            "v1.5.0-rc2",
            "v1.5.0-rc1",
            "v1.5.0-rc0",
            "v1.4.0",
            "v1.4.0-rc2",
            "v1.4.0-rc1",
            "v1.4.0-rc0",
            "v1.3.0",
            "v1.3.0-rc2",
            "v1.3.0-rc1",
            "v1.3.0-rc0",
            "v1.2.0",
            "v1.2.0-rc3",
            "v1.2.0-rc2",
            "v1.2.0-rc1",
            "v1.2.0-rc0",
            "v1.1.0",
            "v1.1.0-rc4",
            "v1.1.0-rc3",
            "v1.1.0-rc2",
            "v1.1-rc2",
            "v1.1-rc1",
            "v1.1-rc0",
            "v1.0",
            "v1.0-rc4",
            "v1.0-rc3",
            "v1.0-rc2",
            "v1.0-rc1",
            "v1.0-rc0",
            "v0.14.0-rc0",
            "v0.13.0-rc0",
            "v0.12.0-rc0",
            "v0.11.0-rc0",
            "v0.5.0",
            "v0.4.4",
            "v0.4.3",
            "v0.4.2",
            "v0.4.1",
            "v0.4.0",
            "v0.3.0",
            "v0.2.0",
            "v0.1.6",
            "v0.1.5",
            "v0.1.4",
            "v0.1.3",
            "v0.1.1",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1981.json"
          }
        }
      ],
      "modified": "2026-10-24T10:30:34.284114840Z",
      "provider": "osv",
      "references": [
        "https://security.gentoo.org/glsa/201604-01",
        "https://bugzilla.redhat.com/show_bug.cgi?id=1298570",
        "https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg03454.html"
      ],
      "provider_metadata": {
        "unresolved_ranges": [
          {
            "cpes": [
              "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "debian:debian_linux",
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "7.0"
                  },
                  {
                    "last_affected": "7.0"
                  },
                  {
                    "introduced": "8.0"
                  },
                  {
                    "last_affected": "8.0"
                  }
                ],
                "source": "CPE_STRING"
              }
            ]
          }
        ]
      }
    },
    "related_cves": [
      {
        "value": "CVE-2016-1981",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 433481,
  "published_at": "2016-12-29T22:59:00.417+00:00"
}