CVE-2016-8576: Medium severity qemu vulnerability
Quick Emulator(Qemu) built with the USB xHCI controller emulation support is vulnerable to an infinite loop issue. It could occur while processing USB command ring in 'xhciringfetch'.
A privileged user/process inside guest could use this issue to crash the Qemu process on the host leading to DoS.
Upstream patch -------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg01265.html
Other sources
The xhciringfetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8576?
CVE-2016-8576 is classified as a high severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2016-8576?
To fix CVE-2016-8576, upgrading QEMU to version 2.8.0 or higher is recommended.
Which software is affected by CVE-2016-8576?
CVE-2016-8576 affects QEMU versions up to 2.7.1 and specific versions of Red Hat OpenStack, openSUSE, and Debian.
What type of attack is possible with CVE-2016-8576?
CVE-2016-8576 allows a privileged user within a guest to crash the QEMU process on the host, leading to a denial of service.
Is CVE-2016-8576 exploitable remotely?
CVE-2016-8576 requires local access to the guest environment for exploitation, making it less likely to be a remote attack.