Input validation error in QEMU - CVE-2016-8909
Published: November 4, 2016 / Updated: July 28, 2020
Vulnerability identifier: #VU32134
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-8909
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows local guest OS administrators to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position.
Affected software
QEMU
qemu (Alpine package)
qemu (Alpine package)
How to mitigate CVE-2016-8909
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
qemu (Alpine package) - update to 2.8.1-r1
External References
- http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html
- http://www.openwall.com/lists/oss-security/2016/10/24/1
- http://www.openwall.com/lists/oss-security/2016/10/24/4
- http://www.securityfocus.com/bid/93842
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg04682.html
- https://security.gentoo.org/glsa/201611-11