CVE-2016-8909: Medium severity qemu vulnerability
Quick Emulator(Qemu) built with the Intel HDA controller emulation support is vulnerable to an infinite loop issue. It could occur while processing the DMA buffer stream while doing data transfer in 'intelhdaxfer'.
A privileged user inside guest could use this flaw to consume excessive CPU cycles on the host, resulting in DoS.
Upstream patch -------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg04717.html
Other sources
The intelhdaxfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8909?
CVE-2016-8909 is classified as a medium severity vulnerability.
How do I fix CVE-2016-8909?
To fix CVE-2016-8909, upgrade QEMU to version 2.8 or later, which includes the necessary patches.
Who is affected by CVE-2016-8909?
CVE-2016-8909 affects users of QEMU versions up to 2.7.1 that utilize the Intel HDA controller emulation.
What impact does CVE-2016-8909 have on affected systems?
CVE-2016-8909 can lead to excessive CPU usage by allowing a malicious privileged user in the guest system to trigger an infinite loop.
Is CVE-2016-8909 exploitable remotely?
CVE-2016-8909 is not remotely exploitable as it requires a privileged user to exploit the vulnerability within the guest.