CVE-2016-6833
Ubuntu Security Notice USN-3125-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active.
Vulnerabilidad de uso después de liberación de memoria en la función vmxnet3_io_bar0_write en hw/net/vmxnet3.c en QEMU (también conocido como Quick Emulator) permite a administradores locales del SO invitado provocar una denegación de servicio (caída de la instancia QEMU) aprovechando el fallo para comprobar si el dispositivo está activo.
Zhenhao Hong discovered that QEMU incorrectly handled the Virtio module. A privileged attacker inside the guest could use this issue to cause QEMU to consume resources, resulting in a denial of service. Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network card emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-08-17 CVE Reserved
- 2016-09-26 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-416: Use After Free
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=6c352ca9b4ee3e1e286ea9e8434bd8e69ac7d0d8 | X_refsource_confirm | |
| http://www.openwall.com/lists/oss-security/2016/08/12/1 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2016/08/18/3 | Mailing List |
|
| http://www.securityfocus.com/bid/93255 | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://lists.gnu.org/archive/html/qemu-devel/2016-08/msg01602.html | 2023-02-12 |
| URL | Date | SRC |
|---|---|---|
| https://security.gentoo.org/glsa/201609-01 | 2023-02-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Qemu Search vendor "Qemu" | Qemu Search vendor "Qemu" for product "Qemu" | <= 2.6.2 Search vendor "Qemu" for product "Qemu" and version " <= 2.6.2" | - |
Affected
| ||||||
| Qemu Search vendor "Qemu" | Qemu Search vendor "Qemu" for product "Qemu" | 2.7.0 Search vendor "Qemu" for product "Qemu" and version "2.7.0" | rc0 |
Affected
| ||||||
| Qemu Search vendor "Qemu" | Qemu Search vendor "Qemu" for product "Qemu" | 2.7.0 Search vendor "Qemu" for product "Qemu" and version "2.7.0" | rc1 |
Affected
| ||||||
| Qemu Search vendor "Qemu" | Qemu Search vendor "Qemu" for product "Qemu" | 2.7.0 Search vendor "Qemu" for product "Qemu" and version "2.7.0" | rc2 |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||