CVE-2016-9103

Published: Dec 9, 2016Modified: May 6, 2026

6.0

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Exploitability: 1.5 / Impact: 4.0

Source: NVD

Description

The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them.

Affected (2)

Products: Qemu: Qemu · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Qemu Qemu	Up to 2.7.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (14)

http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=eb687602853b4ae656e9236ee4222609f3a6887d

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2016/10/28/1

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/10/30/7

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/93955

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg01790.html

Source: secalert@redhat.com

PatchThird Party Advisory

https://security.gentoo.org/glsa/201611-11

Source: secalert@redhat.com

Third Party Advisory

http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=eb687602853b4ae656e9236ee4222609f3a6887d