Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

QEMU lets privileged guest users exhaust memory

CVE-2017-8086 · published 9 years ago
Summary

The QEMU virtual machine software can leak memory when a privileged user inside the guest operating system requests certain file attributes. Over time this can fill up the host’s memory, slowing or stopping the virtual machine. Apply the latest QEMU updates or patches from your distribution to stop the leak.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
qemu qemu <= 2.8.1
2.9.0
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*
debian debian_linux 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Original advisory text
Memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (memory consumption) via vectors i...
Memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (memory consumption) via vectors involving the orig_value variable.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-772Missing Release of Resource after Effective Lifetime
Timeline
Published2 May 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-8086 · NVD
Track software like this
Free during beta