RHSA-2016_1943
Vulnerability from csaf_redhat - Published: 2016-09-27 16:01 - Updated: 2024-11-14 20:48Summary
Red Hat Security Advisory: kvm security update
Severity
Important
Notes
Topic: An update for kvm is now available for Red Hat Enterprise Linux 5.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: KVM (for Kernel-based Virtual Machine) is a full virtualization solution for Linux on x86 hardware. Using KVM, one can run multiple virtual machines running unmodified Linux or Windows images. Each virtual machine has private virtualized hardware: a network card, disk, graphics adapter, etc.
Security Fix(es):
* An out-of-bounds read/write access flaw was found in the way QEMU's VGA emulation with VESA BIOS Extensions (VBE) support performed read/write operations using I/O port methods. A privileged guest user could use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process. (CVE-2016-3710)
* Quick Emulator(QEMU) built with the virtio framework is vulnerable to an unbounded memory allocation issue. It was found that a malicious guest user could submit more requests than the virtqueue size permits. Processing a request allocates a VirtQueueElement results in unbounded memory allocation on the host controlled by the guest. (CVE-2016-5403)
Red Hat would like to thank Wei Xiao (360 Marvel Team) and Qinghao Tang (360 Marvel Team) for reporting CVE-2016-3710 and hongzhenhao (Marvel Team) for reporting CVE-2016-5403.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out-of-bounds read/write access flaw was found in the way QEMU's VGA emulation with VESA BIOS Extensions (VBE) support performed read/write operations using I/O port methods. A privileged guest user could use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process.
7.6 (High)
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
Note: The procedure in the Solution section must be performed before this update will take effect.
https://access.redhat.com/errata/RHSA-2016:1943
Quick Emulator (QEMU) built with the virtio framework is vulnerable to an unbounded memory allocation issue. It was found that a malicious guest user could submit more requests than the virtqueue size permits. Processing a request allocates a VirtQueueElement results in unbounded memory allocation on the host controlled by the guest.
Vendor Fix
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
Note: The procedure in the Solution section must be performed before this update will take effect.
https://access.redhat.com/errata/RHSA-2016:1943
References
Acknowledgments
360.cn Marvel Team
Qinghao Tang
Wei Xiao
Marvel Team
hongzhenhao
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for kvm is now available for Red Hat Enterprise Linux 5.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "KVM (for Kernel-based Virtual Machine) is a full virtualization solution for Linux on x86 hardware. Using KVM, one can run multiple virtual machines running unmodified Linux or Windows images. Each virtual machine has private virtualized hardware: a network card, disk, graphics adapter, etc.\n\nSecurity Fix(es):\n\n* An out-of-bounds read/write access flaw was found in the way QEMU\u0027s VGA emulation with VESA BIOS Extensions (VBE) support performed read/write operations using I/O port methods. A privileged guest user could use this flaw to execute arbitrary code on the host with the privileges of the host\u0027s QEMU process. (CVE-2016-3710)\n\n* Quick Emulator(QEMU) built with the virtio framework is vulnerable to an unbounded memory allocation issue. It was found that a malicious guest user could submit more requests than the virtqueue size permits. Processing a request allocates a VirtQueueElement results in unbounded memory allocation on the host controlled by the guest. (CVE-2016-5403)\n\nRed Hat would like to thank Wei Xiao (360 Marvel Team) and Qinghao Tang (360 Marvel Team) for reporting CVE-2016-3710 and hongzhenhao (Marvel Team) for reporting CVE-2016-5403.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1943",
"url": "https://access.redhat.com/errata/RHSA-2016:1943"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1331401",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1331401"
},
{
"category": "external",
"summary": "1358359",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1358359"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1943.json"
}
],
"title": "Red Hat Security Advisory: kvm security update",
"tracking": {
"current_release_date": "2024-11-14T20:48:19+00:00",
"generator": {
"date": "2024-11-14T20:48:19+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1943",
"initial_release_date": "2016-09-27T16:01:25+00:00",
"revision_history": [
{
"date": "2016-09-27T16:01:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-27T16:01:26+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:48:19+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product": {
"name": "Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_virtualization:5::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product": {
"name": "Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_virtualization:5::server"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "kmod-kvm-debug-0:83-276.el5_11.x86_64",
"product": {
"name": "kmod-kvm-debug-0:83-276.el5_11.x86_64",
"product_id": "kmod-kvm-debug-0:83-276.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kmod-kvm-debug@83-276.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kmod-kvm-0:83-276.el5_11.x86_64",
"product": {
"name": "kmod-kvm-0:83-276.el5_11.x86_64",
"product_id": "kmod-kvm-0:83-276.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kmod-kvm@83-276.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kvm-0:83-276.el5_11.x86_64",
"product": {
"name": "kvm-0:83-276.el5_11.x86_64",
"product_id": "kvm-0:83-276.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm@83-276.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kvm-tools-0:83-276.el5_11.x86_64",
"product": {
"name": "kvm-tools-0:83-276.el5_11.x86_64",
"product_id": "kvm-tools-0:83-276.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm-tools@83-276.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kvm-qemu-img-0:83-276.el5_11.x86_64",
"product": {
"name": "kvm-qemu-img-0:83-276.el5_11.x86_64",
"product_id": "kvm-qemu-img-0:83-276.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm-qemu-img@83-276.el5_11?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "kvm-debuginfo-0:83-276.el5_11.x86_64",
"product": {
"name": "kvm-debuginfo-0:83-276.el5_11.x86_64",
"product_id": "kvm-debuginfo-0:83-276.el5_11.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm-debuginfo@83-276.el5_11?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "kvm-0:83-276.el5_11.src",
"product": {
"name": "kvm-0:83-276.el5_11.src",
"product_id": "kvm-0:83-276.el5_11.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/kvm@83-276.el5_11?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-0:83-276.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kmod-kvm-0:83-276.el5_11.x86_64"
},
"product_reference": "kmod-kvm-0:83-276.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-debug-0:83-276.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kmod-kvm-debug-0:83-276.el5_11.x86_64"
},
"product_reference": "kmod-kvm-debug-0:83-276.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-276.el5_11.src as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-0:83-276.el5_11.src"
},
"product_reference": "kvm-0:83-276.el5_11.src",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-276.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-0:83-276.el5_11.x86_64"
},
"product_reference": "kvm-0:83-276.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-debuginfo-0:83-276.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-debuginfo-0:83-276.el5_11.x86_64"
},
"product_reference": "kvm-debuginfo-0:83-276.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-qemu-img-0:83-276.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-qemu-img-0:83-276.el5_11.x86_64"
},
"product_reference": "kvm-qemu-img-0:83-276.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-tools-0:83-276.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)",
"product_id": "5Client-VT-5.11.Z:kvm-tools-0:83-276.el5_11.x86_64"
},
"product_reference": "kvm-tools-0:83-276.el5_11.x86_64",
"relates_to_product_reference": "5Client-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-0:83-276.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kmod-kvm-0:83-276.el5_11.x86_64"
},
"product_reference": "kmod-kvm-0:83-276.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kmod-kvm-debug-0:83-276.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kmod-kvm-debug-0:83-276.el5_11.x86_64"
},
"product_reference": "kmod-kvm-debug-0:83-276.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-276.el5_11.src as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-0:83-276.el5_11.src"
},
"product_reference": "kvm-0:83-276.el5_11.src",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-0:83-276.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-0:83-276.el5_11.x86_64"
},
"product_reference": "kvm-0:83-276.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-debuginfo-0:83-276.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-debuginfo-0:83-276.el5_11.x86_64"
},
"product_reference": "kvm-debuginfo-0:83-276.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-qemu-img-0:83-276.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-qemu-img-0:83-276.el5_11.x86_64"
},
"product_reference": "kvm-qemu-img-0:83-276.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "kvm-tools-0:83-276.el5_11.x86_64 as a component of Red Hat Enterprise Linux Virtualization (v. 5 server)",
"product_id": "5Server-VT-5.11.Z:kvm-tools-0:83-276.el5_11.x86_64"
},
"product_reference": "kvm-tools-0:83-276.el5_11.x86_64",
"relates_to_product_reference": "5Server-VT-5.11.Z"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Qinghao Tang",
"Wei Xiao"
],
"organization": "360.cn Marvel Team"
}
],
"cve": "CVE-2016-3710",
"discovery_date": "2016-04-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1331401"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-bounds read/write access flaw was found in the way QEMU\u0027s VGA emulation with VESA BIOS Extensions (VBE) support performed read/write operations using I/O port methods. A privileged guest user could use this flaw to execute arbitrary code on the host with the privileges of the host\u0027s QEMU process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qemu: incorrect banked access bounds checking in vga module",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-276.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-276.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-276.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-3710"
},
{
"category": "external",
"summary": "RHBZ#1331401",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1331401"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-3710",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-3710"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3710",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3710"
}
],
"release_date": "2016-05-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-27T16:01:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nNote: The procedure in the Solution section must be performed before this update will take effect.",
"product_ids": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-276.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-276.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-276.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1943"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:A/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-276.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-276.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-276.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qemu: incorrect banked access bounds checking in vga module"
},
{
"acknowledgments": [
{
"names": [
"hongzhenhao"
],
"organization": "Marvel Team"
}
],
"cve": "CVE-2016-5403",
"discovery_date": "2016-07-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1358359"
}
],
"notes": [
{
"category": "description",
"text": "Quick Emulator (QEMU) built with the virtio framework is vulnerable to an unbounded memory allocation issue. It was found that a malicious guest user could submit more requests than the virtqueue size permits. Processing a request allocates a VirtQueueElement results in unbounded memory allocation on the host controlled by the guest.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Qemu: virtio: unbounded memory allocation on host via guest leading to DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-276.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-276.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-276.el5_11.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-5403"
},
{
"category": "external",
"summary": "RHBZ#1358359",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1358359"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-5403",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-5403"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-5403",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5403"
}
],
"release_date": "2016-07-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-27T16:01:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nNote: The procedure in the Solution section must be performed before this update will take effect.",
"product_ids": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-276.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-276.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-276.el5_11.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1943"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"5Client-VT-5.11.Z:kmod-kvm-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kmod-kvm-debug-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-0:83-276.el5_11.src",
"5Client-VT-5.11.Z:kvm-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-debuginfo-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-qemu-img-0:83-276.el5_11.x86_64",
"5Client-VT-5.11.Z:kvm-tools-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kmod-kvm-debug-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-0:83-276.el5_11.src",
"5Server-VT-5.11.Z:kvm-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-debuginfo-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-qemu-img-0:83-276.el5_11.x86_64",
"5Server-VT-5.11.Z:kvm-tools-0:83-276.el5_11.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Qemu: virtio: unbounded memory allocation on host via guest leading to DoS"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…