CVE request Qemu: net: e1000 infinite loop in start_xmit and e1000_receive_iov routines

[P J P <ppandit () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

  Hello,

Qemu emulator built with the e1000 NIC emulation support is vulnerable to an 
infinite loop issue. It could occur while processing data via transmit or 
receive descriptors, provided the initial receive/transmit descriptor 
head(TDH/RDH) is set outside the allocated descriptor buffer.

A privileged user inside guest could use this flaw to crash the Qemu instance 
resulting in DoS.

Upstream patch
- --------------
  -> https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg03454.html

Reference:
- ----------
  -> https://bugzilla.redhat.com/show_bug.cgi?id=1298570

Thank you.
- --
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJWnnGuAAoJEN0TPTL+WwQfM3sP/1VRTdBss1oIFirNs52Tpsyl
KmZBC5tPP7u+x9KWSQIClCRQcMHV09b5fvFnf7F86tNtFd/7Fhh6OpVQ9gpENpw1
enYDmDixD5eNJCpTiLAAoKznrvN/PmiFYcuQbCI9nxnEZUb46Ocw0WYQNm6PC9w2
wHj6oKfAOBCn0nmHZL7mHygRQeJdrufWFWBvx2aJyU+9a/TMAZ58iegj/ymW9V3L
7+FZMEcEuKDEHf7z06NNAbS+tjJb0DoYoEUxXL8ZvX2P813hr5uoZarXa0wVVNCS
gfcLPET2UKSlzP88vQyypKWVExofWr7s1VLH93x6CCvqpvoizVRIoDOMNPKUZSMB
2rTPTT9Z+Dr/c7o84Q2Tan9Yu6+8fd6fasGt7T0tTvOzlhXHFJNpnPriHiTOJBlV
+T2WD8CE7q7uWog+GaxL4Fc5JgHLwF6q1aZVWYcgyDakRRP1SeuajEydSuxcq+EY
gkNlX6k902JTNjoa3IYcQwe2Kv3zZ7avpbq8LxlyhKo0+FNst2xpaZS0KFIna9cs
Jiblnrw1E3of8XaZnNObLkNXfDvBanMhf/VTuzxKe1MxvWAzuo9iILLx9U+I8pHU
H5m5d8/qNlzclcB9atghb15AvMe2ddB997+U8rbhDHV7aqkzwTj0vy0+2tsRwYJ4
yoXLJL9V6CQzYYdprvlI
=T2Vb
-----END PGP SIGNATURE-----