CVE-2020-10756

CVE-2020-10756 is a concrete vulnerability in the QEMU SLiRP networking (libslirp) implementation. The issue is an out-of-bounds read in icmp6_send_echoreply() when replying to ICMP echo requests, enabling a guest to leak host memory and cause information disclosure. Affected component/version: l...

CVE-2021-3593

CVE-2021-3593 (libslirp) : A flaw in the SLiRP networking implementation of QEMU exists in the udp6_input() path, where processing a UDP packet smaller than the size of the udphdr can cause an out-of-bounds read or indirect host memory disclosure to the guest. Affected versions are libslirp prior...

CVE-2021-3592

CVE-2021-3592 describes an invalid pointer initialization in the SLiRP networking implementation of QEMU, specifically in the bootp_input() function. A malicious guest could process a UDP packet smaller than the bootp_t structure and leak 10 bytes of uninitialized host heap memory, impacting data...

CVE-2021-3595

CVE-2021-3595 describes an invalid pointer initialization in the SLiRP networking code of QEMU (tftp_input()), which can trigger when processing UDP packets smaller than the tftp_t structure. The vulnerability may cause an out-of-bounds read or indirect host memory disclosure to the guest, compro...

CVE-2021-3594

CVE-2021-3594 affects the SLiRP networking in QEMU, specifically the udp_input() path. The issue is an invalid pointer initialization that can occur when processing a UDP packet smaller than the udphdr size, leading to out-of-bounds reads or indirect host memory disclosure to the guest. The highe...