CVE-2016-2538

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function.

References

http://git.qemu.org/?p=qemu.git;a=commit;h=fe3c546c5ff2a6210f9a4d8561cc64051ca8603e

http://lists.nongnu.org/archive/html/qemu-stable/2016-03/msg00064.html

http://www.openwall.com/lists/oss-security/2016/02/22/3

http://www.securityfocus.com/bid/83336

http://www.ubuntu.com/usn/USN-2974-1

https://bugzilla.redhat.com/show_bug.cgi?id=1303120

https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html

https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg03658.html

https://security.gentoo.org/glsa/201604-01

Details

Source: MITRE

Published: 2016-06-16

Updated: 2018-12-01

Type: CWE-189

Risk Information

CVSS v2

Base Score: 3.6

Vector: AV:L/AC:L/Au:N/C:P/I:N/A:P

Impact Score: 4.9

Exploitability Score: 3.9

Severity: LOW

CVSS v3

Base Score: 7.1

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Impact Score: 5.2

Exploitability Score: 1.8

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* versions up to 2.5.0 (inclusive)

Tenable Plugins

View all (22 total)

IDNameProductFamilySeverity
135559EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2020-1430)NessusHuawei Local Security Checks
critical
131585EulerOS 2.0 SP2 : qemu-kvm (EulerOS-SA-2019-2431)NessusHuawei Local Security Checks
critical
130689EulerOS 2.0 SP5 : qemu-kvm (EulerOS-SA-2019-2227)NessusHuawei Local Security Checks
critical
119310Debian DLA-1599-1 : qemu security updateNessusDebian Local Security Checks
critical
93180SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1785-1)NessusSuSE Local Security Checks
critical
93177SUSE SLES11 Security Update : xen (SUSE-SU-2016:1745-1)NessusSuSE Local Security Checks
critical
93170SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1703-1)NessusSuSE Local Security Checks
critical
93169SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1698-1)NessusSuSE Local Security Checks
critical
91980openSUSE Security Update : qemu (openSUSE-2016-839)NessusSuSE Local Security Checks
critical
91660SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1560-1)NessusSuSE Local Security Checks
critical
91249SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:1318-1)NessusSuSE Local Security Checks
critical
91122Ubuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : qemu, qemu-kvm vulnerabilities (USN-2974-1)NessusUbuntu Local Security Checks
critical
90478openSUSE Security Update : xen (openSUSE-2016-439)NessusSuSE Local Security Checks
critical
90468Fedora 22 : qemu-2.3.1-13.fc22 (2016-bfaf6a133b)NessusFedora Local Security Checks
high
90396SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2016:0955-1)NessusSuSE Local Security Checks
critical
90339GLSA-201604-01 : QEMU: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
90260openSUSE Security Update : xen (openSUSE-2016-413)NessusSuSE Local Security Checks
critical
90210Fedora 24 : qemu-2.5.0-10.fc24 (2016-1b264ab4a4)NessusFedora Local Security Checks
high
90186SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:0873-1)NessusSuSE Local Security Checks
critical
90130Fedora 23 : qemu-2.4.1-8.fc23 (2016-372bb57df0)NessusFedora Local Security Checks
high
90045Fedora 23 : xen-4.5.2-9.fc23 (2016-f4504e9445)NessusFedora Local Security Checks
high
90036Fedora 22 : xen-4.5.2-9.fc22 (2016-38b20aa50f)NessusFedora Local Security Checks
high