CVE-2016-3710 The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes a...
HighCVSS 8.8
EPSS 0.92%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/qemu(Debian:12) | < 1:2.6+dfsg-1 | 1:2.6+dfsg-1 |
| debian/qemu(Debian:13) | < 1:2.6+dfsg-1 | 1:2.6+dfsg-1 |
| debian/qemu(Debian:14) | < 1:2.6+dfsg-1 | 1:2.6+dfsg-1 |
| debian/xen(Debian:12) | < 4.4.0-1 | 4.4.0-1 |
| debian/xen(Debian:13) | < 4.4.0-1 | 4.4.0-1 |
| debian/xen(Debian:14) | < 4.4.0-1 | 4.4.0-1 |
| debian linux | = 8.0 | No fix listed |
| HP Inc helion openstack | = 2.0.0 | No fix listed |
| HP Inc helion openstack | = 2.1.0 | No fix listed |
| HP Inc helion openstack | = 2.1.2 | No fix listed |
| HP Inc helion openstack | = 2.1.4 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| qemu | <= 2.5.1 | No fix listed |
| qemu | = 2.6.0-rc0 | No fix listed |
| qemu | = 2.6.0-rc1 | No fix listed |
| qemu | = 2.6.0-rc2 | No fix listed |
| qemu | = 2.6.0-rc3 | No fix listed |
| qemu | = 2.6.0-rc4 | No fix listed |
| oracle vm server | = 3.2 | No fix listed |
| oracle vm server | = 3.3 | No fix listed |
| oracle vm server | = 3.4 | No fix listed |
| oracle linux | = 5 | No fix listed |
Show 28 more
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle linux | = 6 | No fix listed |
| oracle linux | = 7 | No fix listed |
| citrix xenserver | <= 7.0 | No fix listed |
| redhat openstack | = 5.0 | No fix listed |
| redhat openstack | = 6.0 | No fix listed |
| redhat openstack | = 7.0 | No fix listed |
| redhat openstack | = 8 | No fix listed |
| redhat virtualization | = 3.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.2 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.2 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.7 | No fix listed |
| redhat enterprise linux server tus | = 7.2 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-3710 vendor-advisory
- RHSA-2016:0724 third-party-advisory vendor-advisory
- RHSA-2016:0725 third-party-advisory vendor-advisory
- RHSA-2016:0997 third-party-advisory vendor-advisory
- RHSA-2016:0999 third-party-advisory vendor-advisory
- RHSA-2016:1000 third-party-advisory vendor-advisory
- RHSA-2016:1001 third-party-advisory vendor-advisory
- RHSA-2016:1002 third-party-advisory vendor-advisory
- RHSA-2016:1019 third-party-advisory vendor-advisory
- RHSA-2016:1943 third-party-advisory vendor-advisory
- support.citrix.com third-party-advisory
- DSA-3573 third-party-advisory vendor-advisory
- [oss-security] 20160509 CVE-2016-3710 Qemu: vga: out-of-bounds r/w access issue mailing-list third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- 90316 third-party-advisory vdb-entry
- 1035794 third-party-advisory vdb-entry
- USN-2974-1 third-party-advisory vendor-advisory
- xenbits.xen.org third-party-advisory
- RHSA-2016:1224 third-party-advisory vendor-advisory
- h20566.www2.hpe.com third-party-advisory vendor-advisory
- [Qemu-devel] 20160509 [PULL 1/5] vga: fix banked access bounds checking (CVE-2016-3710) mailing-list patch third-party-advisory
- bugs.debian.org issue-tracking