Unrated severityNVD Advisory· Published Nov 7, 2014· Updated Jun 17, 2026
CVE-2014-3640
CVE-2014-3640
Description
The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
38cpe:2.3:a:qemu:qemu:2.0.0:-:*:*:*:*:*:*+ 13 more
- cpe:2.3:a:qemu:qemu:2.0.0:-:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.0.0:rc0:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.1.0:rc0:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.1.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.1.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.1.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.1.0:rc5:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:2.1.1:*:*:*:*:*:*:*
- (no CPE)range: <2.1.2
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- osv-coords15 versionspkg:rpm/opensuse/xen&distro=openSUSE%20Tumbleweedpkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Desktop%2011%20SP4pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Desktop%2012pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP2-LTSSpkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSSpkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1
< 4.7.0_12-1.3+ 14 more
- (no CPE)range: < 4.7.0_12-1.3
- (no CPE)range: < 4.4.4_02-32.1
- (no CPE)range: < 4.4.4_02-22.19.1
- (no CPE)range: < 4.5.2_06-7.1
- (no CPE)range: < 4.1.6_08-26.1
- (no CPE)range: < 4.2.5_20-24.9
- (no CPE)range: < 4.4.4_02-32.1
- (no CPE)range: < 4.4.4_02-22.19.1
- (no CPE)range: < 4.5.2_06-7.1
- (no CPE)range: < 4.4.4_02-32.1
- (no CPE)range: < 4.4.4_02-22.19.1
- (no CPE)range: < 4.5.2_06-7.1
- (no CPE)range: < 4.4.4_02-32.1
- (no CPE)range: < 4.4.4_02-22.19.1
- (no CPE)range: < 4.5.2_06-7.1
Patches
Vulnerability mechanics
References
9- lists.nongnu.org/archive/html/qemu-devel/2014-09/msg03543.htmlnvdPatchVendor Advisory
- lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04598.htmlnvdPatchVendor Advisory
- lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04707.htmlnvdPatchVendor Advisory
- rhn.redhat.com/errata/RHSA-2015-0349.htmlnvdThird Party Advisory
- rhn.redhat.com/errata/RHSA-2015-0624.htmlnvdThird Party Advisory
- www.debian.org/security/2014/dsa-3045nvdThird Party Advisory
- www.ubuntu.com/usn/USN-2409-1nvdThird Party Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue Tracking
- www.debian.org/security/2014/dsa-3044nvd
News mentions
0No linked articles in our index yet.