Vulnerability CVE-2016-6490: Information
Description
The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the descriptor buffer.
Severity: MEDIUM (4.4) Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| pve-qemu | sisyphus | 2.6.1-alt1 | 8.1.5-alt1 | ALT-PU-2016-1874-1 | 168779 | Fixed |
| pve-qemu | p10 | 2.6.1-alt1 | 7.2.0-alt4 | ALT-PU-2016-1874-1 | 168779 | Fixed |
| pve-qemu | p9 | 2.6.1-alt1 | 5.1.0-alt6 | ALT-PU-2016-1874-1 | 168779 | Fixed |
| pve-qemu | p8 | 2.6.1-alt1 | 2.12.1-alt1 | ALT-PU-2016-1875-1 | 168787 | Fixed |
| pve-qemu | c10f1 | 2.6.1-alt1 | 7.2.0-alt3 | ALT-PU-2016-1874-1 | 168779 | Fixed |
| pve-qemu | c9f2 | 2.6.1-alt1 | 5.1.0-alt6 | ALT-PU-2016-1874-1 | 168779 | Fixed |
| qemu | sisyphus | 2.8.0-alt1 | 8.2.3-alt1 | ALT-PU-2017-1043-1 | 176467 | Fixed |
| qemu | p10 | 2.8.0-alt1 | 8.2.2-alt0.p10.1 | ALT-PU-2017-1043-1 | 176467 | Fixed |
| qemu | p9 | 2.8.0-alt1 | 5.2.0-alt6 | ALT-PU-2017-1043-1 | 176467 | Fixed |
| qemu | p8 | 2.11.0-alt0.M80P.1 | 2.11.0-alt0.M80P.4 | ALT-PU-2018-1018-1 | 197530 | Fixed |
| qemu | c10f1 | 2.8.0-alt1 | 8.2.2-alt0.p10.1 | ALT-PU-2017-1043-1 | 176467 | Fixed |
| qemu | c9f2 | 2.8.0-alt1 | 5.2.0-alt6.c9.1 | ALT-PU-2017-1043-1 | 176467 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| [oss-security] 20160728 Re: CVE Request Qemu: virtio: infinite loop in virtqueue_pop |
|
| [oss-security] 20160728 CVE Request Qemu: virtio: infinite loop in virtqueue_pop |
|
| [qemu-devel] 20160726 [PATCH] virtio: check vring descriptor buffer length |
|
| GLSA-201609-01 |
|
| http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=1e7aed70144b4673fc26e73062064b6724795e5f |