CVE-2016-6835: Medium severity qemu vulnerability
Quick Emulator(Qemu) built with the VMWARE VMXNET3 NIC device support is vulnerable to an OOB access issue. In that it does not check if packet headers does not check for IP header length. It could lead to a OOB access when reading further packet data.
A privileged user inside guest could use this issue to crash the Qemu process instance or potentially execute arbitrary code on the host, with privileges of the Qemu process.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-stable/2016-08/msg00077.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/08/18/4
Other sources
The vmxnettxpktparseheaders function in hw/net/vmxnettxpkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (buffer over-read) by leveraging failure to check IP header length.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6835?
CVE-2016-6835 is considered a medium-severity vulnerability due to its potential for out-of-bounds (OOB) access.
How do I fix CVE-2016-6835?
To fix CVE-2016-6835, upgrade QEMU to a version higher than 2.6.0 that addresses this vulnerability.
Which versions of QEMU are affected by CVE-2016-6835?
CVE-2016-6835 affects QEMU versions prior to 2.6.0.
What type of systems are impacted by CVE-2016-6835?
CVE-2016-6835 impacts systems running QEMU with VMWARE VMXNET3 NIC device support.
Who can exploit CVE-2016-6835?
CVE-2016-6835 can be exploited by a privileged user inside a guest operating system.