Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in…
Priority MEDIUM 48CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- Partial Red Hat: 13 fixed, 1 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-120 and the CVSS impact.
Summary
Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet.
Why it matters now
EPSS 0.04904 92nd percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 13 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* | before 1.3.0 | Vulnerable | QEMU |
| cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:* | 16 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:* | 17 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:* | 18 | Vulnerable | Fedoraproject |
| cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:* | 12.1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:* | 12.2 | Vulnerable | openSUSE |
| cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:*:*:* | 11 sp1 | Vulnerable | SUSE |
| cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:* | 5.9 | Vulnerable | Red Hat |
- cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·QEMU
- cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:* Versions 16 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:17:*:*:*:*:*:*:* Versions 17 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:* Versions 18 Vulnerable ·Fedoraproject
- cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:* Versions 12.2 Vulnerable ·openSUSE
- cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:*:*:* Versions 11 sp1 Vulnerable ·SUSE
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:* Versions 5.9 Vulnerable ·Red Hat
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:* | 6.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:* | 5.9 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:* | 6.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Running on | Red Hat |
| cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Debian |
| cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:* | 10.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:* | 11.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* | 12.10 | Vulnerable | Canonical |
- cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:* Versions 5.9 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Debian
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:* Versions 10.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:* Versions 11.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* Versions 12.10 Vulnerable ·Canonical
Remediation
Red Hat 6 advisories
- RHSA-2013:0636 Released 2013-03-13 · Red Hat rating Importantrhev-hypervisor6 security and bug fix update
- RHEV Hypervisor for RHEL-6 rhev-hypervisor6-6.4-20130306.2.el6_4
- RHSA-2013:0639 Released 2013-03-12 · Red Hat rating Importantqemu-kvm-rhev security update
- OpenStack Folsom qemu-img-rhev-2:0.12.1.2-2.355.el6_4.2, qemu-kvm-rhev-2:0.12.1.2-2.355.el6_4.2, qemu-kvm-rhev-tools-2:0.12.1.2-2.355.el6_4.2
- RHSA-2013:0609 Released 2013-03-07 · Red Hat rating Importantqemu-kvm security update
- Red Hat Enterprise Linux Desktop (v. 6) qemu-guest-agent-2:0.12.1.2-2.355.el6_4.2, qemu-img-2:0.12.1.2-2.355.el6_4.2, qemu-kvm-2:0.12.1.2-2.355.el6_4.2 +1
- Red Hat Enterprise Linux Desktop Optional (v. 6) qemu-guest-agent-win32-2:0.12.1.2-2.355.el6_4.2, qemu-kvm-2:0.12.1.2-2.355.el6_4.2
- Red Hat Enterprise Linux HPC Node (v. 6) qemu-guest-agent-2:0.12.1.2-2.355.el6_4.2, qemu-img-2:0.12.1.2-2.355.el6_4.2, qemu-kvm-2:0.12.1.2-2.355.el6_4.2 +1
- Red Hat Enterprise Linux HPC Node Optional (v. 6) qemu-guest-agent-win32-2:0.12.1.2-2.355.el6_4.2, qemu-kvm-2:0.12.1.2-2.355.el6_4.2
- Red Hat Enterprise Linux Server (v. 6) qemu-guest-agent-2:0.12.1.2-2.355.el6_4.2, qemu-img-2:0.12.1.2-2.355.el6_4.2, qemu-kvm-2:0.12.1.2-2.355.el6_4.2 +1
- Red Hat Enterprise Linux Server Optional (v. 6) qemu-guest-agent-win32-2:0.12.1.2-2.355.el6_4.2, qemu-kvm-2:0.12.1.2-2.355.el6_4.2
- Red Hat Enterprise Linux Workstation (v. 6) qemu-guest-agent-2:0.12.1.2-2.355.el6_4.2, qemu-img-2:0.12.1.2-2.355.el6_4.2, qemu-kvm-2:0.12.1.2-2.355.el6_4.2 +1
- Red Hat Enterprise Linux Workstation Optional (v. 6) qemu-guest-agent-win32-2:0.12.1.2-2.355.el6_4.2, qemu-kvm-2:0.12.1.2-2.355.el6_4.2
Show 3 more Red Hat advisories
- RHSA-2013:0610 Released 2013-03-07 · Red Hat rating Importantqemu-kvm-rhev security update
- RHEV Agents (vdsm) qemu-img-rhev-2:0.12.1.2-2.355.el6_4.2, qemu-kvm-rhev-2:0.12.1.2-2.355.el6_4.2, qemu-kvm-rhev-tools-2:0.12.1.2-2.355.el6_4.2
- RHSA-2013:0608 Released 2013-03-07 · Red Hat rating Importantkvm security update
- RHEL Virtualization (v. 5 server) kmod-kvm-83-262.el5_9.1, kmod-kvm-debug-83-262.el5_9.1, kvm-83-262.el5_9.1 +2
- RHSA-2013:0599 Released 2013-03-06 · Red Hat rating Importantxen security update
- RHEL Virtualization (v. 5 server) xen-3.0.3-142.el5_9.2, xen-3.0.3-142.el5_9.2.i386, xen-3.0.3-142.el5_9.2.ia64 +3
- Red Hat Enterprise Linux (v. 5 server) xen-3.0.3-142.el5_9.2, xen-libs-3.0.3-142.el5_9.2, xen-libs-3.0.3-142.el5_9.2.i386 +1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix yet |
| OpenStack Folsom | Fixed | RHSA-2013:0639 |
| RHEL Virtualization (v. 5 server) | Fixed | RHSA-2013:0599, RHSA-2013:0608 |
| RHEV Agents (vdsm) | Fixed | RHSA-2013:0610 |
| RHEV Hypervisor for RHEL-6 | Fixed | RHSA-2013:0636 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2013:0599 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2013:0609 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2013:0609 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2013:0609 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2013:0609 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2013:0609 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2013:0609 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2013:0609 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2013:0609 |
Timeline
- 2026-10-02 Threatist record created from CVE-2012-6075
- 2026-10-03 Alias added: GHSA-mw8m-jhfq-5hv9
References
Advisory 18
- FEDORA-2013-0965
- DSA-2608
- openSUSE-SU-2013:0637
- GLSA-201309-24
- [oss-security] 20121229 Re: CVE request: qemu e1000 emulated device gues-side buffer overflow
- DSA-2607
- https://bugzilla.redhat.com/show_bug.cgi?id=889301
- RHSA-2013:0639
- RHSA-2013:0608
- FEDORA-2013-0934
- RHSA-2013:0610
- RHSA-2013:0609
- USN-1692-1
- openSUSE-SU-2013:0636
- SUSE-SU-2014:0446
- DSA-2619
- RHSA-2013:0599
- FEDORA-2013-0971
Sources
- CVE-2012-6075 · CVE Program
- CVE-2012-6075 · NVD
- FIRST EPSS
- GHSA-mw8m-jhfq-5hv9 · GitHub Advisory Database · CC BY 4.0
- CVE-2012-6075 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences