CVE-2016-10028: Medium severity Qemu Qemu vulnerability
The virglcmdgetcapset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a VIRTIOGPUCMDGETCAPSET command with a maximum capabilities size with a value of 0.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10028?
CVE-2016-10028 has been classified as a high severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2016-10028?
To fix CVE-2016-10028, you should upgrade QEMU to the latest version that is not affected, preferably beyond version 2.8.1.1.
What systems are affected by CVE-2016-10028?
CVE-2016-10028 affects QEMU versions up to and including 2.8.1.1 that have Virtio GPU Device emulator support enabled.
What type of vulnerability is CVE-2016-10028?
CVE-2016-10028 is a denial of service vulnerability that can be exploited by local guest OS users.
What command is associated with the exploitation of CVE-2016-10028?
The exploitation of CVE-2016-10028 is associated with the VIRTIO_GPU_CMD_GET_CAPSET command.