CVE-2016-2391

What it actually does

The flaw triggers a NULL pointer dereference in the ohci_bus_start function of QEMU's USB OHCI emulation when handling multiple eof_timers, causing the QEMU process to crash.

Why it matters to the business

A malicious or compromised guest virtual machine can disrupt the host emulator, leading to downtime for virtualized workloads and reduced availability of dependent services.

How an attack unfolds

A local administrator inside a guest OS sends crafted requests to the USB OHCI controller that activate multiple eof_timers; this exercises the vulnerable code path in hw/usb/hcd-ohci.c and forces the NULL dereference that terminates QEMU.

How to fix it

Upgrade QEMU to a version that correctly handles eof_timers in ohci_bus_start; for the listed packages apply the fixed thanos-0.31 release (version 0).

How to confirm the fix worked

Confirm the running QEMU binary is newer than the vulnerable release; run a controlled guest test that exercises multiple eof_timers and verify the emulator remains stable.

Typical attack path

1. Obtain local administrator privileges inside a QEMU guest
2. Interact with USB OHCI emulation via guest drivers or utilities
3. Trigger multiple eof_timers to reach the NULL pointer dereference
4. Cause QEMU process termination on the host

How to detect it

Review hypervisor and system logs for QEMU crashes that coincide with USB OHCI activity in guest virtual machines.

What your security team should do

• Apply the QEMU fix to all virtualization hosts
• Limit guest administrator privileges to the minimum required
• Monitor host logs for unexpected QEMU terminations