QEMU e1000: guest-triggered stack overflow in the loopback receive path crashes the host QEMU process

Impact

A user inside a guest can drive the emulated e1000 device into loopback mode with a short frame and overrun a stack buffer in the host QEMU process. The advisory claims denial of service only: the QEMU process dies, taking that VM with it. On a virtualized GPU cloud that means a tenant can reliably kill their own instance and, more importantly, exercise a memory-corruption path in the process that owns the passthrough GPU and the VFIO mappings for that node. Only guests configured with the e1000 NIC model are reachable; virtio-net guests are not affected by this path.

Who can reach it

Any authenticated user inside a guest VM that has an emulated e1000 NIC. No host access and no special guest privilege beyond the ability to configure the interface is described in the record.

What to do

Apply the distro QEMU update (Red Hat tracks it per RHEL 6 through 10 and OpenShift Container Platform 4; the record does not name fixed package versions, so check the vendor page for your stream). Running guests keep the old QEMU binary in memory, so the fix only lands after each VM is live-migrated off and restarted or stopped and started, which on a GPU host means draining tenant workloads. Interim mitigation without a restart window: move affected guests to virtio-net instead of the e1000 model.

References