CVE-2016-8578: Null Pointer Dereference
The v9fsiovvunmarshal function in fsdev/9p-iov-marshal.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) by sending an empty string parameter to a 9P operation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8578?
CVE-2016-8578 has a medium severity rating due to its ability to cause denial of service through a NULL pointer dereference.
How do I fix CVE-2016-8578?
To fix CVE-2016-8578, upgrade QEMU to version 2.7.2 or later where the vulnerability has been addressed.
What software is affected by CVE-2016-8578?
CVE-2016-8578 affects QEMU versions up to and including 2.7.1, as well as specific Linux distributions such as openSUSE Leap 42.2 and Debian 8.0.
Who can exploit CVE-2016-8578?
CVE-2016-8578 can be exploited by local guest OS administrators who can send malicious parameters to the 9P operation.
What is the impact of CVE-2016-8578?
The impact of CVE-2016-8578 is a denial of service which results in the QEMU process crashing.