CVE-2016-9106: Medium severity qemu vulnerability
Published Dec 9, 2016
·Updated
Memory leak in the v9fswrite function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) by leveraging failure to free an IO vector.
Affected Software
3 affected components
Qemu Qemu<=2.7.1
openSUSE Leap=42.2
Debian Debian Linux=8.0
Remediation
Event History
Dec 9, 2016
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-9106?
CVE-2016-9106 is classified as a medium severity vulnerability due to its potential to cause denial of service.
2
How do I fix CVE-2016-9106?
To mitigate CVE-2016-9106, update QEMU to version 2.8 or later, which addresses this memory leak issue.
3
Which software versions are affected by CVE-2016-9106?
CVE-2016-9106 affects QEMU versions up to 2.7.1, openSUSE Leap 42.2, and Debian 8.0.
4
How does CVE-2016-9106 exploit memory management?
CVE-2016-9106 takes advantage of the v9fs_write function's failure to free an IO vector, causing memory leaks.
5
Who can exploit CVE-2016-9106?
CVE-2016-9106 can be exploited by local guest OS administrators who have control over the affected QEMU instances.