CVE-2016-9776: Medium severity qemu vulnerability
QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcffecreceive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS.
Other sources
Quick Emulator(Qemu) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcffecreceive'.
A privileged user/process inside guest could use this issue to crash the Qemu process on the host leading to DoS.
Upstream patch -------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg05324.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/12/02/3
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9776?
CVE-2016-9776 is classified as a high severity vulnerability due to its potential to crash the QEMU process on the host.
How do I fix CVE-2016-9776?
To mitigate CVE-2016-9776, upgrade to QEMU version 2.8.0 or later, which contains the necessary patches.
Who is affected by CVE-2016-9776?
CVE-2016-9776 affects QEMU versions up to 2.7.1 and the specific release candidates 2.8.0-rc0, 2.8.0-rc1, and 2.8.0-rc2.
Can CVE-2016-9776 be exploited remotely?
Exploitation of CVE-2016-9776 requires a privileged user or process within the guest environment, making it less likely to be exploited remotely.
What kind of issue is CVE-2016-9776?
CVE-2016-9776 is an infinite loop issue occurring in the ColdFire Fast Ethernet Controller emulator while receiving packets.