CVE-2014-3640

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-11-07 · updated 2026-06-17
Weakness: CWE-476

Description

The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.

Affected products

Canonical Ubuntu Linux: 10.04, 12.04, 14.04, 14.10
Debian Linux: 7.0
QEMU: 2.0.0, 2.0.0-rc0, 2.0.0-rc1, 2.0.0-rc2, 2.0.0-rc3, 2.0.2 (+7)
RedHat Enterprise Linux Desktop: 7.0
RedHat Enterprise Linux Hpc Node: 7.0
RedHat Enterprise Linux Server: 7.0
RedHat Enterprise Linux Workstation: 7.0

References

http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg03543.html
http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04598.html
http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04707.html
http://rhn.redhat.com/errata/RHSA-2015-0349.html
http://rhn.redhat.com/errata/RHSA-2015-0624.html
http://www.debian.org/security/2014/dsa-3044
http://www.debian.org/security/2014/dsa-3045
http://www.ubuntu.com/usn/USN-2409-1
https://bugzilla.redhat.com/show_bug.cgi?id=1144818
http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg03543.html
http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04598.html
http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04707.html

Get alerted when CVE-2014-3640 or the next vulnerability affects your stack