CVE-2016-9921: Divide by Zero
Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process instance on the host, resulting in DoS.
Other sources
Quick emulator(Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA.
A privileged user inside guest could use this flaw to crash the Qemu process instance on the host, resulting in DoS.
Upstream patch -------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg03968.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/12/08/9
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9921?
CVE-2016-9921 is categorized as a high severity vulnerability due to the potential for a denial of service condition.
How do I fix CVE-2016-9921?
To fix CVE-2016-9921, update QEMU to version 2.8.1 or later, or apply any available patches from your Linux distribution.
What is the impact of CVE-2016-9921?
An attacker with privileged user access in a guest environment could exploit CVE-2016-9921 to crash the QEMU process on the host.
Which versions of QEMU are affected by CVE-2016-9921?
CVE-2016-9921 affects QEMU versions up to and including 2.7.1 and specific release candidates of 2.8.0.
Is CVE-2016-9921 present in specific Linux distributions?
CVE-2016-9921 is known to affect Debian 8.0 and various versions of Red Hat OpenStack.