CVE-2016-7466: Medium severity qemu vulnerability
Memory leak in the usbxhciexit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of service (memory consumption and possibly QEMU process crash) by repeatedly unplugging a USB device.
Other sources
Quick Emulator(Qemu) built with the USB xHCI controller emulation support is vulnerable to a memory leakage issue. It could occur while doing a USB device unplug operation; Doing so repeatedly would result in leaking host memory, affecting other services on the host.
A privileged user inside guest could use this flaw to cause a DoS on the host and/or potentially crash the Qemu process instance on the host.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg02773.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/09/19/8
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7466?
CVE-2016-7466 is considered a high severity vulnerability that can cause denial of service due to memory leak.
How do I fix CVE-2016-7466?
To fix CVE-2016-7466, upgrade to a version of QEMU later than 2.7.1 that addresses this memory leak issue.
Which software is affected by CVE-2016-7466?
CVE-2016-7466 affects QEMU versions up to 2.7.1, as well as various versions of Red Hat OpenStack and openSUSE Leap 42.2.
What type of attack can be performed using CVE-2016-7466?
An attacker can exploit CVE-2016-7466 by repeatedly unplugging a USB device, leading to memory consumption and potential crash of the QEMU process.
Is CVE-2016-7466 a remote attack vector?
CVE-2016-7466 requires local access by guest OS administrators, making it a local privilege escalation vulnerability.