CVE-2016-7466

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-7466
Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of service (memory consumption and possibly QEMU process crash) by repeatedly unplugging a USB device.

6.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

1.9 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=b53dd4495ced2432a0b652ea895e651d07336f7e
http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/19/8 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/20/3 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/93029 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:2392 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2408 Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg02773.html Patch Third Party Advisory
https://security.gentoo.org/glsa/201611-11 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:11:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
History

12 Feb 2023, 23:25

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2016-7466', 'name': 'https://access.redhat.com/security/cve/CVE-2016-7466', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1377837', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1377837', 'tags': [], 'refsource': 'MISC'}
Summary A memory-leak flaw was found in the Quick Emulator(QEMU) built with USB xHCI controller emulation support. The flaw could occur while doing a USB-device unplug operation. Unplugging the device repeatedly resulted in leaking host memory, which affected other services on the host. A privileged user inside the guest could exploit this flaw to cause a denial of service on the host or potentially crash the host's QEMU process instance. Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of service (memory consumption and possibly QEMU process crash) by repeatedly unplugging a USB device.

02 Feb 2023, 16:17

Type Values Removed Values Added
Summary Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of service (memory consumption and possibly QEMU process crash) by repeatedly unplugging a USB device. A memory-leak flaw was found in the Quick Emulator(QEMU) built with USB xHCI controller emulation support. The flaw could occur while doing a USB-device unplug operation. Unplugging the device repeatedly resulted in leaking host memory, which affected other services on the host. A privileged user inside the guest could exploit this flaw to cause a denial of service on the host or potentially crash the host's QEMU process instance.
References
  • {'url': 'http://git.qemu.org/?p=qemu.git;a=commit;h=b53dd4495ced2432a0b652ea895e651d07336f7e', 'name': 'http://git.qemu.org/?p=qemu.git;a=commit;h=b53dd4495ced2432a0b652ea895e651d07336f7e', 'tags': ['Patch', 'Vendor Advisory'], 'refsource': 'CONFIRM'}
  • (MISC) http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=b53dd4495ced2432a0b652ea895e651d07336f7e -
  • (MISC) https://access.redhat.com/security/cve/CVE-2016-7466 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1377837 -

04 Aug 2021, 17:15

Type Values Removed Values Added
CPE cpe:2.3:a:redhat:openstack:9.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:11.0:*:*:*:*:*:*:*		 cpe:2.3:a:redhat:openstack:11:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*
Information

Published : 2016-12-10 00:59

Updated : 2023-12-10 12:01

NVD link : CVE-2016-7466

Mitre link : CVE-2016-7466

CVE.ORG link : CVE-2016-7466

JSON object : View

Products Affected

redhat

  • enterprise_linux
  • openstack
  • virtualization

qemu

  • qemu

opensuse

  • leap
CWE
CWE-772

Missing Release of Resource after Effective Lifetime