CVE-2016-3710

HIGH

QEMU VGA Dark Portal - Guest-to-Host Code Execution

Title source: manual
STIX 2.1

Description

The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.

References (22)

Core 22
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-0999.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/90316
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-0725.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-1000.html
Third Party Advisory x_refsource_confirm
http://support.citrix.com/article/CTX212736
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-1002.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-1001.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-0997.html
Third Party Advisory, Vendor Advisory x_refsource_confirm
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1035794
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-1943.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-1019.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2974-1
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/05/09/3
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-0724.html
Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist
https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg01197.html
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2016:1224
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3573
Third Party Advisory x_refsource_confirm
http://xenbits.xen.org/xsa/advisory-179.html

Scores

CVSS v3 8.8
EPSS 0.0007
EPSS Percentile 22.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-119
Status published
Products (43)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 15.10
canonical/ubuntu_linux 16.04
citrix/xenserver < 7.0
debian/debian_linux 8.0
hp/helion_openstack 2.0.0
hp/helion_openstack 2.1.0
hp/helion_openstack 2.1.2
hp/helion_openstack 2.1.4
... and 33 more
Published May 11, 2016
Tracked Since Feb 18, 2026