Homepage

Loop with Unreachable Exit Condition ('Infinite Loop') The advisory has been revoked - it doesn't affect any version of package qemu-linux-user  (opens in a new tab)

Threat Intelligence

EPSS
0.51% (41st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES151-QEMULINUXUSER-2726113
  • published14 Apr 2022
  • disclosed12 Nov 2019
Report a new vulnerability Found a mistake?

Introduced: 12 Nov 2019

CVE-2019-12068  (opens in a new tab)
CWE-835  (opens in a new tab)

Amendment

The SLES security team deemed this advisory irrelevant for SLES:15.1.

NVD Description

Note: Versions mentioned in the description apply only to the upstream qemu-linux-user package and not the qemu-linux-user package as distributed by SLES.

In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.

References