CVE-2016-2198

CVE-2016-2198 affects QEMU when built with USB EHCI emulation. The root cause is a null pointer dereference in ehci_caps_write during writes to EHCI capability registers, which could be triggered by a privileged user inside the guest and may crash the QEMU process, causing a DoS. Technical detail...

CVE-2016-9913

CVE-2016-9913 affects QEMU’s 9pfs backend (hw/9pfs/9p.c) where a memory leak in v9fs_device_unrealize_common can be triggered by the order of resource cleanup. This local privilege-adjacent issue may cause host memory consumption and potentially crash the QEMU process. The vulnerability is discus...

CVE-2015-8818

CVE-2015-8818 (QEMU) affects the CPU path in QEMU where cpu_physical_memory_write_rom_internal in exec.c fails to skip MMIO regions, allowing a local privileged guest user to crash the guest (DoS) via unspecified vectors. Public details confirm the issue and multiple advisories reference fixes; r...

CVE-2015-8701

CVE-2015-8701 affects QEMU with Rocker switch emulation. Affected path is tx_consume processing of TX descriptors; if a descriptor has more than ROCKER_TX_FRAGS_MAX (16) fragments, an off-by-one error can cause memory leakage on the host or crash the QEMU process, leading to DoS. Exploitation det...

CVE-2015-8744

CVE-2015-8744 affects QEMU when built with a VMXNET3 paravirtual NIC; the issue arises from improper/layer-2 header handling for very small frames (less than 22 bytes), which could be exploited by a privileged guest to crash the QEMU process and cause DoS. Public details in Debian/related advisor...

CVE-2015-8745

CVE-2015-8745 affects QEMU with VMXNET3 paravirtual NIC emulation. Issue: reading Interrupt Mask Registers (IMR) can crash the QEMU process when exploited by a privileged guest (CAP_SYS_RAWIO), causing DoS. Connected data confirms the crash is tied to IMR access, not a remote exploit, and multipl...

CVE-2016-1981

QEMU aka Quick Emulator built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head TDH/RDH is set outside the allocated descriptor buffer. A...

CVE-2015-8817

QEMU aka Quick Emulator built to use 'addressspacetranslate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pcidmaread/write calls. Affects QEMU versions = 1.6.0 and = 2.3.1. A privileged user inside guest could use this flaw to cra...

CVE-2015-8817

CVE-2015-8817 : QEMU is vulnerable to an out-of-bounds read/write when mapping a memory address to a MemoryRegionSection using address_space_translate during pci_dma_read/write calls. This could allow a privileged guest user to crash the guest (DoS). Affected products/versions include QEMU 1.6.0–...

CVE-2015-8743

CVE-2015-8743 affects QEMU with NE2000 device emulation. The flaw is an out-of-bounds read/write in ioport r/w operations, exploitable by a privileged (CAP_SYS_RAWIO) user to leak or corrupt QEMU memory. Public fixes exist (e.g., vendor security updates, notably in SUSE/OpenSUSE advisories) that ...

CVE-2016-9846

CVE-2016-9846 affects QEMU with Virtio GPU device emulation. The vulnerability is a memory leakage in virgl cursor data update (update_cursor_data_virgl), which could allow a guest user/process to leak host memory, causing a host DoS. Connected advisories (Ubuntu USN-3261-1, Fedora/Fedora-derived...

CVE-2016-9845

CVE-2016-9845 affects QEMU with Virtio GPU Device emulator support. The vulnerability arises when processing the VIRTIO_GPU_CMD_GET_CAPSET_INFO command, allowing a guest user/process to leak contents of host memory. The issue is described as an information leak in virgl_cmd_get_capset_info, tied ...

CVE-2016-1981

CVE-2016-1981 affects QEMU built with the e1000 NIC emulation. The issue is an infinite loop that can occur while processing data via transmit or receive descriptors when the initial TDH/RDH is outside the allocated descriptor buffer. A privileged user inside the guest could crash the QEMU instan...

UBUNTU-CVE-2016-9913

Memory leak in the v9fsdeviceunrealizecommon function in hw/9pfs/9p.c in QEMU aka Quick Emulator allows local privileged guest OS users to cause a denial of service host memory consumption and possibly QEMU process crash via vectors involving the order of resource cleanup...

UBUNTU-CVE-2016-9916

Memory leak in hw/9pfs/9p-proxy.c in QEMU aka Quick Emulator allows local privileged guest OS users to cause a denial of service host memory consumption and possibly QEMU process crash by leveraging a missing cleanup operation in the proxy backend...

CVE-2016-9912

Quick Emulator Qemu built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtiogpuresourcedestroy'. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host...

CVE-2016-9923

Quick Emulator Qemu built with the 'chardev' backend support is vulnerable to a use after free issue. It could occur while hotplug and unplugging the device in the guest. A guest user/process could use this flaw to crash a Qemu process on the host resulting in DoS...

CVE-2016-9911

Quick Emulator Qemu built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host...

CVE-2016-9911

Quick Emulator Qemu built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host...

CVE-2016-9908

Quick Emulator Qemu built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIOGPUCMDGETCAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes...