What is CVE-2016-8910?

CVE-2016-8910 is a medium-severity vulnerability in Qemu, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 6.0/10. Published 2016-11-04.

How severe is CVE-2016-8910?

Medium severity. CVSS v3 base score is 6.0 out of 10.

Vulnerability in Qemu

CVE-2016-8910

The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor c…

EPSS: 0.001 (26.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H.

Affected products

Qemu
Debian Debian_linux — versions 8.0
Opensuse Leap — versions 42.2
Redhat Enterprise_linux — versions 7.0
Redhat Openstack — versions 6.0, 7.0, 8
Redhat Virtualization — versions 4.0
N/a — versions n/a

Weakness classification (CWE)

CWE-835 — Loop with Unreachable Exit Condition (Infinite Loop)

References

GLSA-201611-11 (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
[oss-security] 20161024 Re: CVE request Qemu: net: rtl8139: infinite loop while transmit in C+ mode (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
RHSA-2017:2392 (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
openSUSE-SU-2016:3237 (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
93844 (Third Party Advisory, VDB Entry, vdb-entry, x_refsource_BID)
[qemu-devel] 20161024 [PATCH] net: rtl8139: limit processing of ring descript (mailing-list, x_refsource_MLIST, Patch, Third Party Advisory)
[oss-security] 20161024 CVE request Qemu: net: rtl8139: infinite loop while transmit in C+ mode (mailing-list, x_refsource_MLIST, Patch, Mailing List, Third Party Advisory)
[debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
RHSA-2017:2408 (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2016-8910?: CVE-2016-8910 is a medium-severity vulnerability in Qemu, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 6.0/10. Published 2016-11-04.
How severe is CVE-2016-8910?: Medium severity. CVSS v3 base score is 6.0 out of 10.