CVE-2016-9846: Buffer Overflow
QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while updating the cursor data in updatecursordatavirgl. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9846?
CVE-2016-9846 is classified as a high severity vulnerability due to its potential to cause denial of service (DoS) on the host.
How does CVE-2016-9846 affect QEMU?
CVE-2016-9846 allows a guest user/process to leak host memory bytes during cursor data updates, leading to possible service disruption.
What versions of QEMU are affected by CVE-2016-9846?
QEMU versions up to 2.7.1 and specifically 2.8.0-rc0, 2.8.0-rc1, and 2.8.0-rc2 are affected by CVE-2016-9846.
How do I fix CVE-2016-9846?
To mitigate CVE-2016-9846, users should upgrade to a version of QEMU that is beyond the affected versions, specifically after 2.8.0-rc2.
Is there a workaround for CVE-2016-9846?
Currently, there are no effective workarounds for CVE-2016-9846 other than applying the recommended updates.