CVE-2016-9907 — Missing Release of Resource after Effective Lifetime in Qemu
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 63.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 23
Latest updateMay 13
Description
Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HExploitability: 2.0 | Impact: 4.0
Affected Packages4 packages
Also affects: Debian Linux 8.0
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-j9gg-mhrv-x578: Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw↗2022-05-13
CVEList▶
CVE-2016-9907: Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw↗2016-12-23
OSV▶
CVE-2016-9907: Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw↗2016-12-23