What’s Vulnerable › Vulnerabilities
CVE-2016-5403
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2016-08-02 · updated 2026-06-17
- Weakness: CWE-400
Description
The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.
Affected products
- Canonical Ubuntu Linux: 12.04, 14.04, 16.04
- Debian Linux: 8.0
- Oracle Corporation Oracle Linux: 5, 6, 7
- Oracle Vm Server: 3.4
- QEMU: through 2.6.0; 2.7.0-rc0
- RedHat Enterprise Linux Desktop: 6.0, 7.0
- RedHat Enterprise Linux Server: 6.0, 7.0
- RedHat Enterprise Linux Server Aus: 7.2, 7.3, 7.4, 7.5, 7.6, 7.7
- RedHat Enterprise Linux Server Eus: 7.2, 7.3, 7.4, 7.5, 7.6, 7.7
- RedHat Enterprise Linux Server Tus: 7.2, 7.3, 7.6, 7.7
- RedHat Enterprise Linux Workstation: 6.0, 7.0
- OpenStack: 5.0, 6.0, 7.0, 8, 9
- RedHat Virtualization: 3.0
References
- http://rhn.redhat.com/errata/RHSA-2016-1585.html
- http://rhn.redhat.com/errata/RHSA-2016-1586.html
- http://rhn.redhat.com/errata/RHSA-2016-1606.html
- http://rhn.redhat.com/errata/RHSA-2016-1607.html
- http://rhn.redhat.com/errata/RHSA-2016-1652.html
- http://rhn.redhat.com/errata/RHSA-2016-1653.html
- http://rhn.redhat.com/errata/RHSA-2016-1654.html
- http://rhn.redhat.com/errata/RHSA-2016-1655.html
- http://rhn.redhat.com/errata/RHSA-2016-1756.html
- http://rhn.redhat.com/errata/RHSA-2016-1763.html
- http://rhn.redhat.com/errata/RHSA-2016-1943.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
Get alerted when CVE-2016-5403 or the next vulnerability affects your stack