Lucene search

K
debiancveDebian Security Bug TrackerDEBIANCVE:CVE-2016-9911
HistoryDec 23, 2016 - 10:59 p.m.

CVE-2016-9911

2016-12-2322:59:00
Debian Security Bug Tracker
security-tracker.debian.org
20
qemu
usb
ehci
memory leakage
vulnerability
dos
unix

CVSS2

4.9

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS3

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

EPSS

0.001

Percentile

26.7%

Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in ‘ehci_init_transfer’. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.

OSVersionArchitecturePackageVersionFilename
Debian12allqemu< 1:2.8+dfsg-1qemu_1:2.8+dfsg-1_all.deb
Debian11allqemu< 1:2.8+dfsg-1qemu_1:2.8+dfsg-1_all.deb
Debian999allqemu< 1:2.8+dfsg-1qemu_1:2.8+dfsg-1_all.deb
Debian13allqemu< 1:2.8+dfsg-1qemu_1:2.8+dfsg-1_all.deb

CVSS2

4.9

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS3

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

EPSS

0.001

Percentile

26.7%