CVE-2016-2391MEDIUM
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.
References
http://git.qemu.org/?p=qemu.git;a=commit;h=fa1298c2d623522eda7b4f1f721fcb935abb7360
http://www.openwall.com/lists/oss-security/2016/02/16/2
http://www.securityfocus.com/bid/83263
http://www.ubuntu.com/usn/USN-2974-1
https://bugzilla.redhat.com/show_bug.cgi?id=1304794
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg03374.html
Details
Source: MITRE
Published: 2016-06-16
Updated: 2020-10-15
Type: CWE-476
Risk Information
CVSS v2
Base Score: 2.1
Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Impact Score: 2.9
Exploitability Score: 3.9
Severity: LOW
CVSS v3
Base Score: 5
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Impact Score: 3.6
Exploitability Score: 1.3
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* versions up to 2.5.1.1 (inclusive)
Configuration 2
OR
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Configuration 3
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 135559 | EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2020-1430) | Nessus | Huawei Local Security Checks | critical |
| 131585 | EulerOS 2.0 SP2 : qemu-kvm (EulerOS-SA-2019-2431) | Nessus | Huawei Local Security Checks | critical |
| 119310 | Debian DLA-1599-1 : qemu security update | Nessus | Debian Local Security Checks | critical |
| 94758 | SUSE SLES12 Security Update : qemu (SUSE-SU-2016:2781-1) | Nessus | SuSE Local Security Checks | high |
| 94309 | openSUSE Security Update : qemu (openSUSE-2016-1234) | Nessus | SuSE Local Security Checks | high |
| 94283 | SUSE SLES11 Security Update : kvm (SUSE-SU-2016:2628-1) | Nessus | SuSE Local Security Checks | high |
| 94277 | SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:2589-1) | Nessus | SuSE Local Security Checks | high |
| 93177 | SUSE SLES11 Security Update : xen (SUSE-SU-2016:1745-1) | Nessus | SuSE Local Security Checks | critical |
| 92201 | Fedora 23 : 2:qemu (2016-f2b1f07256) | Nessus | Fedora Local Security Checks | high |
| 92135 | Fedora 22 : 2:qemu (2016-a3298e39f7) | Nessus | Fedora Local Security Checks | high |
| 91649 | SUSE SLES10 Security Update : Xen (SUSE-SU-2016:1445-1) | Nessus | SuSE Local Security Checks | high |
| 91249 | SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:1318-1) | Nessus | SuSE Local Security Checks | critical |
| 91122 | Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : qemu, qemu-kvm vulnerabilities (USN-2974-1) | Nessus | Ubuntu Local Security Checks | critical |
| 90759 | SUSE SLES11 Security Update : xen (SUSE-SU-2016:1154-1) | Nessus | SuSE Local Security Checks | critical |
| 90396 | SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2016:0955-1) | Nessus | SuSE Local Security Checks | critical |
| 90260 | openSUSE Security Update : xen (openSUSE-2016-413) | Nessus | SuSE Local Security Checks | critical |
| 90186 | SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:0873-1) | Nessus | SuSE Local Security Checks | critical |
| 90045 | Fedora 23 : xen-4.5.2-9.fc23 (2016-f4504e9445) | Nessus | Fedora Local Security Checks | high |
| 90036 | Fedora 22 : xen-4.5.2-9.fc22 (2016-38b20aa50f) | Nessus | Fedora Local Security Checks | high |