CVE-2016-5105
First published: Wed May 25 2016(Updated: )
Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support is vulnerable to an information leakage issue. It could occur while processing MegaRAID Firmware Interface(MFI) command to read device configuration in 'megasas_dcmd_cfg_read'. A privileged user inside guest could use this flaw to leak host memory bytes. Upstream patch -------------- -> <a href="https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04419.html">https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04419.html</a> Reference: ---------- -> <a href="http://www.openwall.com/lists/oss-security/2016/05/25/5">http://www.openwall.com/lists/oss-security/2016/05/25/5</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| QEMU qemu | <=2.6.2 | |
| Canonical Ubuntu Linux | =12.04 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =16.04 | |
| Debian Debian Linux | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04419.html
- http://www.openwall.com/lists/oss-security/2016/05/25/5
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1339585
- https://bugzilla.redhat.com/show_bug.cgi?id=1339583
- http://www.openwall.com/lists/oss-security/2016/05/26/7
- http://www.ubuntu.com/usn/USN-3047-1
- http://www.ubuntu.com/usn/USN-3047-2
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-5105
- agent/severity
- agent/author
- agent/last-modified-date
- agent/remedy
- agent/weakness
- agent/tags
- agent/description
- agent/event
- agent/trending
- vendor/qemu
- canonical/qemu qemu
- version/qemu qemu/2.6.2
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/12.04
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/16.04
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0