Description
QEMU (aka Quick Emulator) built to use 'address_space_translate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pci_dma_read/write calls. Affects QEMU versions >= 1.6.0 and <= 2.3.1. A privileged user inside guest could use this flaw to crash the guest instance resulting in DoS.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:2.4+dfsg-1a | — |
| Debian 13 | qemu | 1:2.4+dfsg-1a | — |
| Debian 12 | qemu | 1:2.4+dfsg-1a | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | qemu | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 9 | qemu-img-rhev +3 | 10:2.6.0-27.el7 | RHSA-2016:2671 |
| Red Hat OpenStack 8 | qemu-img-rhev +3 | 10:2.6.0-27.el7 | RHSA-2016:2670 |
| Red Hat OpenStack 7 | qemu-img-rhev +3 | 10:2.6.0-27.el7 | RHSA-2016:2704 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 6 | qemu-img-rhev +3 | 10:2.6.0-27.el7 | RHSA-2016:2705 |
| Red Hat OpenStack 5 | qemu-img-rhev +3 | 10:2.6.0-27.el7 | RHSA-2016:2706 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | qemu | 2.3.1-14.1 | SUSE-SU-2016:1703-1 |
| SLES 12 SP1 | xen | 4.5.2_06-7.1 | SUSE-SU-2016:0873-1 |
| SLES 12 | qemu | 2.0.2-48.19.1 | SUSE-SU-2016:1560-1 |
| SLES 12 | xen | 4.4.4_02-22.19.1 | SUSE-SU-2016:1318-1 |
| SLES 11 SP4 | xen | 4.4.4_02-32.1 | SUSE-SU-2016:0955-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | qemu | 2.3.1-14.1 | SUSE-SU-2016:1703-1 |
| SLES for SAP 12 SP1 | xen | 4.5.2_06-7.1 | SUSE-SU-2016:0873-1 |
| SLES for SAP 12 | qemu | 2.0.2-48.19.1 | SUSE-SU-2016:1560-1 |
| SLES for SAP 12 | xen | 4.4.4_02-22.19.1 | SUSE-SU-2016:1318-1 |
| SLES for SAP 11 SP4 | xen | 4.4.4_02-32.1 | SUSE-SU-2016:0955-1 |
Advisories 10
- RHSA-2016:2706 Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:2704 Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:2705 Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:2671 Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:2670 Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- SUSE-SU-2016:1703-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:1318-1 Security update for xen SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:1560-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0955-1 Security update for xen SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0873-1 Security update for xen SUSE / openSUSE Security Updates · May 2, 2025
References
- RHSA-2016:2671 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1300771
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=23820dbfc79d1c9dce090b4c555994f2bb6a69b3
- RHSA-2016:2706 vendor-advisory
- [oss-security] 20160301 CVE request Qemu: OOB access in address_space_rw leads to segmentation fault mailing-list
- [oss-security] 20160301 Re: CVE request Qemu: OOB access in address_space_rw leads to segmentation fault mailing-list
- RHSA-2016:2705 vendor-advisory
- [qemu-stable] 20160127 [PATCH for v2.3.1] exec: Respect as_translate_internal length clamp mailing-list
- RHSA-2016:2670 vendor-advisory
- RHSA-2016:2704 vendor-advisory
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c3c1bb99d1c11978d9ce94d1bdcf0705378c1459