CVE-2016-9907: Medium severity qemu vulnerability
Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredirhandledestroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.
Other sources
Quick Emulator(Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredirhandledestroy'.
A guest user/process could use this issue to leak host memory, resulting in DoS for a host.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-11/msg01379.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/12/06/3
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9907?
CVE-2016-9907 has a medium severity rating due to its potential to cause a denial of service by leaking host memory.
How do I fix CVE-2016-9907?
To fix CVE-2016-9907, update QEMU to version 2.8 or later, or apply the relevant patches provided by your Linux distribution.
Which versions of QEMU are affected by CVE-2016-9907?
QEMU versions up to 2.7.1 are affected by CVE-2016-9907.
What can happen if CVE-2016-9907 is exploited?
If exploited, CVE-2016-9907 can lead to memory leakage, resulting in a denial of service for the host machine.
Is CVE-2016-9907 present in Red Hat OpenStack?
Yes, CVE-2016-9907 affects several versions of Red Hat OpenStack, including versions 6.0 through 11.