CVE-2016-7156

The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging an incorrect cast.

• CWE-704

• http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=49adc5d3f8c6bb75e55ebfeab109c5c37dea65e8
• http://www.openwall.com/lists/oss-security/2016/09/06/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/09/07/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/92774Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing List, Third Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg00772.htmlPatch, Third Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg01246.htmlPatch, Third Party Advisory
• https://security.gentoo.org/glsa/201609-01Third Party Advisory
• http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=49adc5d3f8c6bb75e55ebfeab109c5c37dea65e8
• http://www.openwall.com/lists/oss-security/2016/09/06/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/09/07/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/92774Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing List, Third Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg00772.htmlPatch, Third Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg01246.htmlPatch, Third Party Advisory
• https://security.gentoo.org/glsa/201609-01Third Party Advisory

Published

Dec 10, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-7150Cross-site scripting (XSS) vulnerability in b2evolution 6.7.…
• CVE-2016-7151Capstone 3.0.4 has an out-of-bounds vulnerability (SEGV caus…
• CVE-2016-7152The HTTPS protocol does not consider the role of the TCP con…
• CVE-2016-7153The HTTP/2 protocol does not consider the role of the TCP co…
• CVE-2016-7154Use-after-free vulnerability in the FIFO event channel code …
• CVE-2016-7155hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows loc…4.4
• CVE-2016-7157The (1) mptsas_config_manufacturing_1 and (2) mptsas_config_…4.4
• CVE-2016-7160A vulnerability on Samsung Mobile M(6.0) devices exists beca…
• CVE-2016-7161Heap-based buffer overflow in the .receive callback of xlnx.…9.8
• CVE-2016-7162The _g_file_remove_directory function in file-utils.c in Fil…7.5
• CVE-2016-7163Integer overflow in the opj_pi_create_decode function in pi.…7.8
• CVE-2016-7164The construct function in puff.cpp in Libtorrent 1.1.0 allow…