Skip to content
OpenAdvisories
Unscored USN-3125-1 28 CVEs

qemu, qemu-kvm vulnerabilities

Published Nov 9, 2016 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Zhenhao Hong discovered that QEMU incorrectly handled the Virtio module. A
privileged attacker inside the guest could use this issue to cause QEMU to
consume resources, resulting in a denial of service. (CVE-2016-5403)

Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network
card emulation support. A privileged attacker inside the guest could use
this issue to cause QEMU to crash, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10.
(CVE-2016-6833, CVE-2016-6834, CVE-2016-6888)

Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network
card emulation support. A privileged attacker inside the guest could use
this issue to cause QEMU to crash, resulting in a denial of service, or
possibly execute arbitrary code on the host. In the default installation,
when QEMU is used with libvirt, attackers would be isolated by the libvirt
AppArmor profile. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04
LTS and Ubuntu 16.10. (CVE-2016-6835)

Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network
card emulation support. A privileged attacker inside the guest could use
this issue to possibly to obtain sensitive host memory. This issue only
affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10.
(CVE-2016-6836)

Felix Wilhelm discovered that QEMU incorrectly handled Plan 9 File System
(9pfs) support. A privileged attacker inside the guest could use this issue
to possibly to obtain sensitive host files. (CVE-2016-7116)

Li Qiang and Tom Victor discovered that QEMU incorrectly handled VMWARE
PVSCSI paravirtual SCSI bus emulation support. A privileged attacker inside
the guest could use this issue to cause QEMU to crash, resulting in a
denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04
LTS and Ubuntu 16.10. (CVE-2016-7155)

Li Qiang discovered that QEMU incorrectly handled VMWARE PVSCSI paravirtual
SCSI bus emulation support. A privileged attacker inside the guest could
use this issue to cause QEMU to crash, resulting in a denial of service.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu
16.10. (CVE-2016-7156, CVE-2016-7421)

Tom Victor discovered that QEMU incorrectly handled LSI SAS1068 host bus
emulation support. A privileged attacker inside the guest could use this
issue to cause QEMU to crash, resulting in a denial of service.
This issue only affected Ubuntu 16.10. (CVE-2016-7157)

Hu Chaojian discovered that QEMU incorrectly handled xlnx.xps-ethernetlite
emulation support. A privileged attacker inside the guest could use this
issue to cause QEMU to crash, resulting in a denial of service, or possibly
execute arbitrary code on the host. In the default installation, when QEMU
is used with libvirt, attackers would be isolated by the libvirt AppArmor
profile. (CVE-2016-7161)

Qinghao Tang and Li Qiang discovered that QEMU incorrectly handled the
VMWare VGA module. A privileged attacker inside the guest could use this
issue to cause QEMU to crash, resulting in a denial of service.
(CVE-2016-7170)

Qinghao Tang and Zhenhao Hong discovered that QEMU incorrectly handled the
Virtio module. A privileged attacker inside the guest could use this issue
to cause QEMU to crash, resulting in a denial of service. This issue only
affected Ubuntu 16.10. (CVE-2016-7422)

Li Qiang discovered that QEMU incorrectly handled LSI SAS1068 host bus
emulation support. A privileged attacker inside the guest could use this
issue to cause QEMU to crash, resulting in a denial of service.
This issue only affected Ubuntu 16.10. (CVE-2016-7423)

Li Qiang discovered that QEMU incorrectly handled USB xHCI controller
emulation support. A privileged attacker inside the guest could use this
issue to cause QEMU to crash, resulting in a denial of service.
This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7466)

Li Qiang discovered that QEMU incorrectly handled ColdFire Fast Ethernet
Controller emulation support. A privileged attacker inside the guest could
use this issue to cause QEMU to crash, resulting in a denial of service.
(CVE-2016-7908)

Li Qiang discovered that QEMU incorrectly handled AMD PC-Net II emulation
support. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. (CVE-2016-7909)

Li Qiang discovered that QEMU incorrectly handled the Virtio GPU support. A
privileged attacker inside the guest could use this issue to cause QEMU to
consume resources, resulting in a denial of service. This issue only
affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7994)

Li Qiang discovered that QEMU incorrectly handled USB EHCI emulation
support. A privileged attacker inside the guest could use this issue to
cause QEMU to consume resources, resulting in a denial of service. This
issue only affected Ubuntu 16.10. (CVE-2016-7995)

Li Qiang discovered that QEMU incorrectly handled USB xHCI controller
support. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. This issue only
affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10.
(CVE-2016-8576)

Li Qiang discovered that QEMU incorrectly handled Plan 9 File System (9pfs)
support. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. This issue only
affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10.
(CVE-2016-8577, CVE-2016-8578)

It was discovered that QEMU incorrectly handled Rocker switch emulation
support. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. This issue only
affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8668)

It was discovered that QEMU incorrectly handled Intel HDA controller
emulation support. A privileged attacker inside the guest could use this
issue to cause QEMU to consume resources, resulting in a denia

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS qemu 2.0.0+dfsg-2ubuntu1.30
Ubuntu · 16.04 LTS 16.04:LTS qemu 1:2.5+dfsg-5ubuntu10.6

Vulnerabilities 28

  • Unscored —
    CVE-2016-5403

    The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of serv…

    qemu xen qemu xen Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-6833

    Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) all…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-6834

    The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS a…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-6835

    The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS a…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-6836

    The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrat…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-6888

    Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-7116

    Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to …

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-7155

    hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (ou…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-7156

    The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administr…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-7161

    Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU (aka Quick Emulator) allows attack…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-7170

    The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrato…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-7421

    The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS admin…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-7466

    Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, a…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-7908

    The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descript…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-7909

    The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cau…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-7994

    Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allow…

    qemu qemu qemu Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-8576

    The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to …

    qemu qemu qemu Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-8577

    Memory leak in the v9fs_read function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators…

    qemu qemu qemu Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-8578

    The v9fs_iov_vunmarshal function in fsdev/9p-iov-marshal.c in QEMU (aka Quick Emulator) allows local guest OS administr…

    qemu qemu qemu Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-8668

    The rocker_io_writel function in hw/net/rocker/rocker.c in QEMU (aka Quick Emulator) allows local guest OS administrato…

    qemu qemu qemu Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-8909

    The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators t…

    qemu qemu qemu Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-8910

    The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrato…

    qemu qemu qemu Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-9101

    Memory leak in hw/net/eepro100.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of…

    qemu qemu qemu Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-9102

    Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS adminis…

    qemu qemu qemu Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-9103

    The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obta…

    qemu qemu qemu Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-9104

    Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Q…

    qemu qemu qemu Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-9105

    Memory leak in the v9fs_link function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators…

    qemu qemu qemu Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-9106

    Memory leak in the v9fs_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrator…

    qemu qemu qemu Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2016-5403
  • report
    https://ubuntu.com/security/CVE-2016-6833
  • report
    https://ubuntu.com/security/CVE-2016-6834
  • report
    https://ubuntu.com/security/CVE-2016-6835
  • report
    https://ubuntu.com/security/CVE-2016-6836
  • report
    https://ubuntu.com/security/CVE-2016-6888
  • report
    https://ubuntu.com/security/CVE-2016-7116
  • report
    https://ubuntu.com/security/CVE-2016-7155
  • report
    https://ubuntu.com/security/CVE-2016-7156
  • report
    https://ubuntu.com/security/CVE-2016-7157
  • report
    https://ubuntu.com/security/CVE-2016-7161
  • report
    https://ubuntu.com/security/CVE-2016-7170
  • report
    https://ubuntu.com/security/CVE-2016-7421
  • report
    https://ubuntu.com/security/CVE-2016-7422
  • report
    https://ubuntu.com/security/CVE-2016-7423
  • report
    https://ubuntu.com/security/CVE-2016-7466
  • report
    https://ubuntu.com/security/CVE-2016-7908
  • report
    https://ubuntu.com/security/CVE-2016-7909
  • report
    https://ubuntu.com/security/CVE-2016-7994
  • report
    https://ubuntu.com/security/CVE-2016-7995
  • report
    https://ubuntu.com/security/CVE-2016-8576
  • report
    https://ubuntu.com/security/CVE-2016-8577
  • report
    https://ubuntu.com/security/CVE-2016-8578
  • report
    https://ubuntu.com/security/CVE-2016-8668
  • report
    https://ubuntu.com/security/CVE-2016-8909
  • report
    https://ubuntu.com/security/CVE-2016-8910
  • report
    https://ubuntu.com/security/CVE-2016-9101
  • report
    https://ubuntu.com/security/CVE-2016-9102
  • report
    https://ubuntu.com/security/CVE-2016-9103
  • report
    https://ubuntu.com/security/CVE-2016-9104
  • report
    https://ubuntu.com/security/CVE-2016-9105
  • report
    https://ubuntu.com/security/CVE-2016-9106