What’s Vulnerable › Vulnerabilities
CVE-2015-6815
- Severity: low (CVSS 3.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-01-31 · updated 2026-06-17
- Weakness: CWE-835
Description
The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.
Affected products
- Arista Networks EOS: 4.12, 4.13, 4.14, 4.15
- Canonical Ubuntu Linux: 12.04, 14.04, 15.04
- Fedoraproject Fedora: 21, 22, 23
- Novell Suse Linux Enterprise Debuginfo: 11.0-sp3, 11.0-sp4
- Novell Suse Linux Enterprise Desktop: 11.0-sp3, 11.0-sp4, 12.0
- Novell Suse Linux Enterprise Server: 11.0-sp3, 11.0-sp4, 12.0
- Novell Suse Linux Enterprise Software Development Kit: 11.0-sp3, 11.0-sp4, 12.0
- QEMU: before 2.4.0.1 — fixed in 2.4.0.1
- Red Hat Enterprise Linux: 5.0, 6.0, 7.0
- OpenStack: 5.0, 6.0, 7.0
- xen: 4.4.3, 4.5.1
How to fix
Upgrade to a fixed version: QEMU 2.4.0.1. Check the vendor advisory for mitigations.
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168077.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168646.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168671.html
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00011.html
- http://www.openwall.com/lists/oss-security/2015/09/04/4
- http://www.openwall.com/lists/oss-security/2015/09/05/5
- http://www.ubuntu.com/usn/USN-2745-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1260076
- https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg01199.html
- https://lists.gnu.org/archive/html/qemu-devel/2015-09/msg05832.html
Get alerted when CVE-2015-6815 or the next vulnerability affects your stack