Skip to content
Fencer Vulns
medium 5.5

CVE-2016-1981 json

QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue.

published 2016-12-29 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-3070

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits
0
none known

Summary

QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS.

Patch / fix

  • qemu Debian 14, Debian 13, Debian 12 1:2.5+dfsg-5

debian advisories DEBIAN-CVE-2016-1981

  • qemu Ubuntu 14.04 LTS 2.0.0+dfsg-2ubuntu1.22

ubuntu advisories UBUNTU-CVE-2016-1981

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • qemu-kvm RHEL 7 10:1.5.3-126.el7
  • qemu-img RHEL 7 10:1.5.3-126.el7
  • qemu-kvm-tools RHEL 7 10:1.5.3-126.el7
  • qemu-kvm-common RHEL 7 10:1.5.3-126.el7

red hat advisories RHSA-2016:2585

  • kvm SLES for SAP 11 SP4, SLES 11 SP4 1.4.2-44.1
  • qemu SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 2.3.1-14.1
  • kvm SLES 11 SP3-TERADATA, SLES 11 SP3-LTSS 1.4.2-46.1
  • qemu SLES for SAP 12, SLES 12, SLED 12 2.0.2-48.19.1
  • xen SLES for SAP 12, SLES 12, SLED 12 +1 more 4.4.4_02-22.19.1
  • xen SLES for SAP 11 SP4, SLES 11 SP4, SLED 11 SP4 +1 more 4.4.4_02-32.1
  • xen SLES for SAP 12 SP1, SLES 12 SP1, SLED 12 SP1 +1 more 4.5.2_06-7.1
  • xen SLES 11 SP3-LTSS 4.2.5_20-24.9

suse advisories SUSE-SU-2016:1785-1SUSE-SU-2016:1745-1SUSE-SU-2016:1703-1SUSE-SU-2016:1698-1SUSE-SU-2016:1560-1SUSE-SU-2016:1318-1

  • xen openSUSE Tumbleweed 4.7.0_12-1.3

opensuse advisories openSUSE-SU-2024:10196-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-1981 updated cvss 2.3

Qemu: net: e1000 infinite loop in start_xmit and e1000_receive_iov routines

  • Red Hat Enterprise Linux 5 kvm, xen Red Hat Enterprise Linux 6 qemu-img, qemu-kvm, qemu-kvm-rhev, qemu-kvm-tools, qemu-guest-agent, qemu-guest-agent-win32 Red Hat Enterprise Linux 7 qemu-kvm-rhev Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse) qemu-kvm-rhev Red Hat Enterprise Linux OpenStack Platform 6 (Juno) qemu-kvm-rhev Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) qemu-img-rhev, qemu-kvm-rhev, libcacard-rhev, qemu-kvm-tools-rhev, libcacard-devel-rhev, libcacard-tools-rhev, +1 more
    +1 more products
    Red Hat OpenStack Platform 8 (Liberty) qemu-img-rhev, qemu-kvm-rhev, libcacard-rhev, qemu-kvm-tools-rhev, libcacard-devel-rhev, libcacard-tools-rhev, +1 more
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux Client (v. 7) qemu-img 1.5.3-126.el7, qemu-kvm 1.5.3-126.el7, qemu-kvm-tools 1.5.3-126.el7, qemu-kvm-common 1.5.3-126.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) qemu-img 1.5.3-126.el7, qemu-kvm 1.5.3-126.el7, qemu-kvm-tools 1.5.3-126.el7, qemu-kvm-common 1.5.3-126.el7 Red Hat Enterprise Linux Server (v. 7) qemu-img 1.5.3-126.el7, qemu-kvm 1.5.3-126.el7, qemu-kvm-tools 1.5.3-126.el7, qemu-kvm-common 1.5.3-126.el7 Red Hat Enterprise Linux Workstation (v. 7) qemu-img 1.5.3-126.el7, qemu-kvm 1.5.3-126.el7, qemu-kvm-tools 1.5.3-126.el7, qemu-kvm-common 1.5.3-126.el7
    fixed: vendor fix RHSA-2016:2585

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.