CVE-2016-7994: Medium severity Qemu Qemu vulnerability
Memory leak in the virtiogpuresourcecreate2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIOGPUCMDRESOURCECREATE2D commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/qemuto a version that resolves this vulnerability.Fixed in 2.8.1-r1
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7994?
CVE-2016-7994 is considered a medium severity vulnerability due to its potential to cause denial of service through memory consumption.
How do I fix CVE-2016-7994?
To fix CVE-2016-7994, update QEMU to version 2.7.2 or later to mitigate the memory leak issue.
Who is affected by CVE-2016-7994?
CVE-2016-7994 affects local guest OS administrators using QEMU versions up to 2.7.1 and openSUSE Leap 42.2.
What type of attack does CVE-2016-7994 facilitate?
CVE-2016-7994 facilitates a denial of service attack by allowing the execution of multiple VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands that consume memory.
Which software versions are impacted by CVE-2016-7994?
CVE-2016-7994 impacts QEMU versions prior to 2.7.2 and specifically openSUSE Leap 42.2.