PT-2016-7651 · Qemu+3 · Qemu+3
Li Qiang
·
Publicado
2016-10-31
·
Atualizado
2024-06-15
·
CVE-2016-9102
CVSS v3.1
6.0
Média
| Vetor | AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
QEMU (aka Quick Emulator) versions prior to the fixed version
Description
A memory leak issue exists in the
v9fs xattrcreate function, allowing local guest OS administrators to cause a denial of service by consuming memory and crashing the QEMU process. This can be achieved by sending a large number of Txattrcreate messages with the same fid number.Recommendations
For versions prior to the fixed version, consider restricting access to the
v9fs xattrcreate function to minimize the risk of exploitation. As a temporary workaround, limiting the number of Txattrcreate messages with the same fid number may help mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Missing Release of Resource after Effective Lifetime
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Qemu
Suse
Ubuntu