Buffer overflow in QEMU - CVE-2016-9103
Published: December 10, 2016 / Updated: July 28, 2020
Vulnerability identifier: #VU32087
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-9103
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to gain access to sensitive information.
The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them.
Affected software
QEMU
qemu (Alpine package)
xen
Fedora
qemu (Alpine package)
xen
Fedora
How to mitigate CVE-2016-9103
Install update from vendor's website.
qemu (Alpine package) - addressed in versions 2.8.1-r1, 2.8.1.1-r0
xen - addressed in versions 4.5.5-3.fc23, 4.6.3-7.fc24, 4.7.0-7.fc25
xen - addressed in versions 4.5.5-3.fc23, 4.6.3-7.fc24, 4.7.0-7.fc25
External References
- http://git.qemu.org/?p=qemu.git;a=commit;h=eb687602853b4ae656e9236ee4222609f3a6887d
- http://www.openwall.com/lists/oss-security/2016/10/28/1
- http://www.openwall.com/lists/oss-security/2016/10/30/7
- http://www.securityfocus.com/bid/93955
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg01790.html
- https://security.gentoo.org/glsa/201611-11