NULL pointer dereference in QEMU - CVE-2016-6888
Published: December 10, 2016 / Updated: August 9, 2020
Vulnerability identifier: #VU39987
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-6888
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.
Affected software
QEMU
SUSE Linux
SUSE Linux
How to mitigate CVE-2016-6888
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
External References
- http://git.qemu.org/?p=qemu.git;a=commit;h=47882fa4975bf0b58dd74474329fdd7154e8f04c
- http://www.openwall.com/lists/oss-security/2016/08/19/10
- http://www.openwall.com/lists/oss-security/2016/08/19/6
- http://www.securityfocus.com/bid/92556
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg03176.html
- https://security.gentoo.org/glsa/201609-01