CVE-2016-3710: Buffer Overflow
Qemu emulator built with VGA emulation with VESA BIOS Extensions(VBE) support is vulnerable to an OOB r/w access issue. It could occur while doing VGA r/w operations via i/o port methods.
A privileged guest user could use this flaw to potentially execute arbitrary code, with privileges of the Qemu process on the host.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg01197.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/05/09/3
Other sources
The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3710?
CVE-2016-3710 has been classified with a moderate severity rating due to its potential to allow arbitrary code execution on the host system.
How do I fix CVE-2016-3710?
To remediate CVE-2016-3710, update QEMU to the latest version that addresses this vulnerability.
What software is affected by CVE-2016-3710?
CVE-2016-3710 affects several software platforms including QEMU versions up to 2.6.0-rc4 and various distributions like Debian 8.0, Ubuntu 12.04, and HP Helion OpenStack.
Can CVE-2016-3710 be exploited remotely?
No, CVE-2016-3710 requires local access to the vulnerable guest operating system to exploit the vulnerability.
What impact does CVE-2016-3710 have on system security?
CVE-2016-3710 allows local guest OS administrators to execute arbitrary code on the host, which compromises isolation between the host and guest environments.