Description
Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:2.6+dfsg-2 | — |
| Debian 13 | qemu | 1:2.6+dfsg-2 | — |
| Debian 12 | qemu | 1:2.6+dfsg-2 | — |
| Debian 8 | qemu | 1:2.1+dfsg-12+deb8u12 | DLA-1927-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | qemu | 1:2.5+dfsg-5ubuntu10.3 | USN-3047-1 |
| Ubuntu 14.04 LTS | qemu | 2.0.0+dfsg-2ubuntu1.26 | USN-3047-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | qemu-img +6 | 10:1.5.3-105.el7_2.7 | RHSA-2016:1606 |
| RHEL 7 | qemu-img-rhev +6 | 10:2.3.0-31.el7_2.21 | RHSA-2016:1607 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 9 | qemu-img-rhev +5 | 10:2.3.0-31.el7_2.21 | RHSA-2016:1763 |
| Red Hat OpenStack 8 | qemu-img-rhev +5 | 10:2.3.0-31.el7_2.21 | RHSA-2016:1756 |
| Red Hat OpenStack 7 | qemu-img-rhev +5 | 10:2.3.0-31.el7_2.21 | RHSA-2016:1653 |
| Red Hat OpenStack 6 | qemu-img-rhev +6 | 10:2.3.0-31.el7_2.21 | RHSA-2016:1654 |
| Red Hat OpenStack 5 | qemu-img-rhev +6 | 10:2.3.0-31.el7_2.21 | RHSA-2016:1655 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | qemu | 2.3.1-21.1 | SUSE-SU-2016:2589-1 |
| SLES 12 SP1 | xen | 4.5.3_08-17.1 | SUSE-SU-2016:2093-1 |
| SLES 12 | qemu | 2.0.2-48.22.1 | SUSE-SU-2016:2781-1 |
| SLES 12 | xen | 4.4.4_04-22.22.2 | SUSE-SU-2016:2533-1 |
| SLES 11 SP4 | kvm | 1.4.2-47.1 | SUSE-SU-2016:2628-1 |
| SLES 11 SP4 | xen | 4.4.4_07-37.1 | SUSE-SU-2016:2100-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | qemu | 2.3.1-21.1 | SUSE-SU-2016:2589-1 |
| SLES for SAP 12 SP1 | xen | 4.5.3_08-17.1 | SUSE-SU-2016:2093-1 |
| SLES for SAP 12 | qemu | 2.0.2-48.22.1 | SUSE-SU-2016:2781-1 |
| SLES for SAP 12 | xen | 4.4.4_04-22.22.2 | SUSE-SU-2016:2533-1 |
| SLES for SAP 11 SP4 | kvm | 1.4.2-47.1 | SUSE-SU-2016:2628-1 |
| SLES for SAP 11 SP4 | xen | 4.4.4_07-37.1 | SUSE-SU-2016:2100-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | qemu | 2.6.1-1.5 | openSUSE-SU-2024:10233-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | qemu-img +6 | 10:1.5.3-105.el7_2.7 | ELSA-2016-1606 |
Advisories 17
- RHSA-2016:1763 Red Hat Security Advisory: qemu-kvm-rhev security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1756 Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1654 Red Hat Security Advisory: qemu-kvm-rhev security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1655 Red Hat Security Advisory: qemu-kvm-rhev security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1653 Red Hat Security Advisory: qemu-kvm-rhev security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1607 Red Hat Security Advisory: qemu-kvm-rhev security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1606 Red Hat Security Advisory: qemu-kvm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DLA-1927-1 qemu - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3047-1 qemu, qemu-kvm vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2016:2781-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2589-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2533-1 Security update for xen SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2628-1 Security update for kvm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2100-1 Security update for xen SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2093-1 Security update for xen SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10233-1 qemu-2.6.1-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2016-1606 Moderate: qemu-kvm security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 11, 2016
References
- RHSA-2016:1756 vendor-advisory
- USN-3047-1 vendor-advisory
- RHSA-2016:1655 vendor-advisory
- [oss-security] 20160530 CVE Request Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl mailing-list
- RHSA-2016:1763 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- 90948 vdb-entry
- RHSA-2016:1653 vendor-advisory
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=a6b3167fa0e825aebb5a7cd8b437b6d41584a196
- RHSA-2016:1607 vendor-advisory
- RHSA-2016:1654 vendor-advisory
- GLSA-201609-01 vendor-advisory
- USN-3047-2 vendor-advisory
- RHSA-2016:1606 vendor-advisory
- [oss-security] 20160530 Re: CVE Request Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl mailing-list
- [qemu-block] 20160524 [Qemu-block] [PATCH] block/iscsi: avoid potential overflow of acb->task->cdb mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1340924
- [debian-lts-announce] 20190920 [SECURITY] [DLA 1927-1] qemu security update mailing-list