CVE-2016-9776: debian debian_linux Infinite Loop
CVSS: 5.5v3.1MediumModified
AliasesUBUNTU-CVE-2016-9776DEBIAN-CVE-2016-9776
Published 29-12-2016Last modified 06-08-2024
Vulnerability summary
CVE-2016-9776 is a medium (CVSS 5.5) Infinite Loop vulnerability in debian debian_linux. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.8% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v3.1 (NVD)EPSS score
0.42%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 11 · Related 10Timeline
- 29-12-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS.
CVSS metrics
5 scores · 3 sources · 3 versionsMedium 5.5Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Medium 5.5Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesSingle source
Low 2.1Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
0.00 pp
From 0.42% on 18-09-2026
18-09-202618-10-2026
EPSS score0.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- qemu< 1:2.8+dfsg-1
- debian_linuxEOL8.0
Qemu1 product
- qemu≤ 2.7.1 | 2.8.0:rc0 | 2.8.0:rc1 | 2.8.0:rc2
Ubuntu1 product
- qemu< 2.0.0+dfsg-2ubuntu1.33 | < 1:2.5+dfsg-5ubuntu10.11
3 vendors · 4 products
References
11 links
lists.debian.org/debian-lts-announce/2018/09/msg00007.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.gnu.org/archive/html/qemu-devel/2016-11/msg05324.htmlMailing ListX Refsource MLISTPatchVendor AdvisoryREPORT