CVE-2020-28916: 
NixOS vulnerability analysis and mitigation

CVE-2020-28916 is a vulnerability discovered in QEMU 5.0.0, specifically in the hw/net/e1000e_core.c component. The vulnerability was reported by Cheol-woo Myung and disclosed in December 2020. The issue affects the e1000e device emulator in QEMU, which is commonly used in virtualization environments like KVM and Xen HVM (Debian LTS).

The vulnerability manifests as an infinite loop condition in the e1000e_write_packet_to_guest() routine when processing RX (receive) descriptors. The issue occurs specifically when an RX descriptor contains a NULL buffer address, causing the descriptor offset to not advance properly (OSS Security). The vulnerability has been assigned a CVSS v3.1 score of 5.5 (Medium), with attack vector being Local, attack complexity Low, and privileges required Low (Ubuntu CVE).

The vulnerability can lead to a denial of service (DoS) condition on the host system. A privileged guest user could potentially exploit this flaw to trigger an infinite loop scenario, affecting the availability of the host system (OSS Security).

The vulnerability requires local access and low privileges to exploit. An attacker would need to be a privileged guest user to trigger the infinite loop condition through the e1000e device emulator (OSS Security).

The vulnerability has been fixed in various QEMU versions across different distributions. The fix involves advancing the descriptor offset even when encountering NULL buffer addresses. Ubuntu has released fixes in versions 1:5.0-5ubuntu9.4 for 20.10, 1:4.2-3ubuntu6.12 for 20.04 LTS, and 1:2.11+dfsg-1ubuntu7.35 for 18.04 LTS (Ubuntu CVE). Debian has also released fixes in version 1:2.8+dfsg-6+deb9u13 for Debian 9 stretch (Debian LTS).