vulnwire
6.5med

CVE-2016-4020

The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administra…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
6.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 31%
Public exploits
0
none known

The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).

Exploit prediction (EPSS)

0.37% probability of exploitation in the next 30 days, higher than 31% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.16.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD2.02.1AV:L/AC:L/Au:N/C:P/I:N/A:N

References

  • git.qemu.org /?p=qemu.git%3Ba=commit%3Bh=691a02e2ce0c413236a78dee6f2651c937b09fb0 · x_refsource_CONFIRM, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=1313686 · x_refsource_CONFIRM, x_transferred
  • lists.gnu.org /archive/html/qemu-devel/2016-04/msg01106.html · mailing-list, x_refsource_MLIST, x_transferred
  • securityfocus.com /bid/86067 · vdb-entry, x_refsource_BID, x_transferred
  • lists.gnu.org /archive/html/qemu-devel/2016-04/msg01118.html · mailing-list, x_refsource_MLIST, x_transferred
  • access.redhat.com /errata/RHSA-2017:2392 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • security.gentoo.org /glsa/201609-01 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • ubuntu.com /usn/USN-2974-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.debian.org /debian-lts-announce/2018/11/msg00038.html · mailing-list, x_refsource_MLIST, x_transferred
  • access.redhat.com /errata/RHSA-2017:2408 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2017:1856 · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.