CVE-2016-6888: Integer Overflow
Integer overflow in the nettxpktinit function in hw/net/nettxpkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.
Other sources
Quick Emulator(Qemu) built with the VMWARE VMXNET3 NIC device support, with network abstraction layer is vulnerable to an integer overflow issue. It could occur while initialisation of a new packets in the device.
A privileged user inside guest could use this flaw to crash the Qemu instance resulting in DoS.
Upstream patch: --------------- -> http://git.qemu.org/?p=qemu.git;a=commit;h=47882fa4975bf0b58dd74474329fdd7154e8f04c
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/08/19/10
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6888?
The severity of CVE-2016-6888 is classified as medium, as it can lead to a denial of service by crashing the QEMU process.
How do I fix CVE-2016-6888?
To fix CVE-2016-6888, update QEMU to version 2.7.0 or later, or apply any available patches provided by your distribution.
Which versions of QEMU are affected by CVE-2016-6888?
CVE-2016-6888 affects QEMU versions up to 2.6.2 and the 2.7.0 release candidates.
Can CVE-2016-6888 be exploited remotely?
CVE-2016-6888 cannot be exploited remotely as it requires local guest OS administrator access.
What is the impact of CVE-2016-6888?
The impact of CVE-2016-6888 is a denial of service, causing the QEMU process to crash due to an integer overflow.