CVE-2016-9846 Information disclosure in n/a
A guest user can leak host memory bytes via the Virtio GPU emulator, potentially causing a denial of service on the host system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-9846?
CVE-2016-9846 is a medium-severity vulnerability in Qemu Qemu, published on 29 Dec 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while updating the cursor data in update_cursor_data_virgl. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.
Weakness: CWE-119
Which versions are affected by CVE-2016-9846?
It affects 1 product.
Products include Qemu Qemu.
How do I fix CVE-2016-9846?
Apply the vendor's patch.
Is CVE-2016-9846 being exploited?
There is no known exploitation of CVE-2016-9846 in the wild and no public exploit code.
Other vulnerabilities in Qemu Qemu
Sources
Also known as DEBIAN-CVE-2016-9846, GHSA-gwq3-r3rx-h2mh, UBUNTU-CVE-2016-9846.