CVE-2016-2392MEDIUM
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.
References
http://git.qemu.org/?p=qemu.git;a=commit;h=80eecda8e5d09c442c24307f340840a5b70ea3b9
http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html
http://www.openwall.com/lists/oss-security/2016/02/16/7
http://www.securityfocus.com/bid/83274
http://www.ubuntu.com/usn/USN-2974-1
https://bugzilla.redhat.com/show_bug.cgi?id=1302299
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg02553.html
Details
Source: MITRE
Published: 2016-06-16
Updated: 2018-12-01
Type: NVD-CWE-Other
Risk Information
CVSS v2
Base Score: 2.1
Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Impact Score: 2.9
Exploitability Score: 3.9
Severity: LOW
CVSS v3
Base Score: 6.5
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Impact Score: 4
Exploitability Score: 2
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
Configuration 2
OR
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 135559 | EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2020-1430) | Nessus | Huawei Local Security Checks | critical |
| 131585 | EulerOS 2.0 SP2 : qemu-kvm (EulerOS-SA-2019-2431) | Nessus | Huawei Local Security Checks | critical |
| 119310 | Debian DLA-1599-1 : qemu security update | Nessus | Debian Local Security Checks | critical |
| 94758 | SUSE SLES12 Security Update : qemu (SUSE-SU-2016:2781-1) | Nessus | SuSE Local Security Checks | high |
| 94309 | openSUSE Security Update : qemu (openSUSE-2016-1234) | Nessus | SuSE Local Security Checks | high |
| 94283 | SUSE SLES11 Security Update : kvm (SUSE-SU-2016:2628-1) | Nessus | SuSE Local Security Checks | high |
| 94277 | SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:2589-1) | Nessus | SuSE Local Security Checks | high |
| 93177 | SUSE SLES11 Security Update : xen (SUSE-SU-2016:1745-1) | Nessus | SuSE Local Security Checks | critical |
| 91249 | SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:1318-1) | Nessus | SuSE Local Security Checks | critical |
| 91122 | Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : qemu, qemu-kvm vulnerabilities (USN-2974-1) | Nessus | Ubuntu Local Security Checks | critical |
| 90478 | openSUSE Security Update : xen (openSUSE-2016-439) | Nessus | SuSE Local Security Checks | critical |
| 90468 | Fedora 22 : qemu-2.3.1-13.fc22 (2016-bfaf6a133b) | Nessus | Fedora Local Security Checks | high |
| 90396 | SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2016:0955-1) | Nessus | SuSE Local Security Checks | critical |
| 90339 | GLSA-201604-01 : QEMU: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
| 90260 | openSUSE Security Update : xen (openSUSE-2016-413) | Nessus | SuSE Local Security Checks | critical |
| 90210 | Fedora 24 : qemu-2.5.0-10.fc24 (2016-1b264ab4a4) | Nessus | Fedora Local Security Checks | high |
| 90186 | SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:0873-1) | Nessus | SuSE Local Security Checks | critical |
| 90130 | Fedora 23 : qemu-2.4.1-8.fc23 (2016-372bb57df0) | Nessus | Fedora Local Security Checks | high |
| 90045 | Fedora 23 : xen-4.5.2-9.fc23 (2016-f4504e9445) | Nessus | Fedora Local Security Checks | high |
| 90036 | Fedora 22 : xen-4.5.2-9.fc22 (2016-38b20aa50f) | Nessus | Fedora Local Security Checks | high |