Vulnerability Description
The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Canonical | Ubuntu Linux | 12.04 |
| Oracle | Linux | 5 |
| Oracle | Vm Server | 3.4 |
| Qemu | Qemu | <= 2.6.0 |
| Debian | Debian Linux | 8.0 |
| Redhat | Openstack | 5.0 |
| Redhat | Virtualization | 3.0 |
| Redhat | Enterprise Linux Desktop | 6.0 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Server Aus | 7.2 |
| Redhat | Enterprise Linux Server Eus | 7.2 |
| Redhat | Enterprise Linux Server Tus | 7.2 |
| Redhat | Enterprise Linux Workstation | 6.0 |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2016-1585.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1586.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1606.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1607.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1652.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1653.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1654.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1655.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1756.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1763.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1943.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.hThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.hThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmThird Party Advisory
- http://www.securityfocus.com/bid/92148Third Party AdvisoryVDB Entry
FAQ
What is CVE-2016-5403?
CVE-2016-5403 is a vulnerability with a CVSS score of 5.5 (MEDIUM). The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without wa...
How severe is CVE-2016-5403?
CVE-2016-5403 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-5403?
Check the references section above for vendor advisories and patch information. Affected products include: Canonical Ubuntu Linux, Oracle Linux, Oracle Vm Server, Qemu Qemu, Debian Debian Linux.