CVE-2016-10155

Published: Mar 15, 2017Modified: May 13, 2026

6.0

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Exploitability: 1.5 / Impact: 4.0

Source: NVD

Description

Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.

Affected (2)

Products: Qemu: Qemu · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Qemu Qemu	Up to 2.8.1.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (16)

http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=eb7a20a3616085d46aa6b4b4224e15587ec67e6e

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2017/01/20/14

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2017/01/21/4

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/95770

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:2392

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2408

Source: cve@mitre.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html

Source: cve@mitre.org

Third Party Advisory

https://security.gentoo.org/glsa/201702-28

Source: cve@mitre.org

Third Party Advisory

http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=eb7a20a3616085d46aa6b4b4224e15587ec67e6e