PT-2016-4900 · Qemu+5 · Qemu+5
Donghai Zdh
·
Publicado
2015-10-12
·
Atualizado
2024-06-15
·
CVE-2016-1714
CVSS v3.1
8.1
Alta
| Vetor | AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
QEMU versions prior to 2.4
Description
The issue concerns the
fw cfg write and fw cfg read functions in QEMU, which can be exploited by guest OS users with the CAP SYS RAWIO privilege to cause a denial of service, including out-of-bounds read or write access and process crash, or possibly execute arbitrary code. This is achieved by providing an invalid current entry value in a firmware configuration.Recommendations
For QEMU versions prior to 2.4, update to version 2.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Firmware Configuration device emulation support to minimize the risk of exploitation.
Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Qemu
Red Hat
Suse
Ubuntu