CVE-2015-8701

QEMU (aka Quick Emulator) built with the Rocker switch emulation support is
vulnerable to an off-by-one error. It happens while processing transmit
(tx) descriptors in ‘tx_consume’ routine, if a descriptor was to have more
than allowed (ROCKER_TX_FRAGS_MAX=16) fragments. A privileged user inside
guest could use this flaw to cause memory leakage on the host or crash the
QEMU process instance resulting in DoS issue.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809313&gt;