CVE-2016-3710

Description

The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.

References

http://www.openwall.com/lists/oss-security/2016/05/09/3

https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg01197.html

http://xenbits.xen.org/xsa/advisory-179.html

http://www.securitytracker.com/id/1035794

http://www.debian.org/security/2016/dsa-3573

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862

http://www.ubuntu.com/usn/USN-2974-1

http://rhn.redhat.com/errata/RHSA-2016-1019.html

https://access.redhat.com/errata/RHSA-2016:1224

http://rhn.redhat.com/errata/RHSA-2016-1002.html

http://rhn.redhat.com/errata/RHSA-2016-1001.html

http://rhn.redhat.com/errata/RHSA-2016-0725.html

http://rhn.redhat.com/errata/RHSA-2016-0999.html

http://rhn.redhat.com/errata/RHSA-2016-1000.html

http://rhn.redhat.com/errata/RHSA-2016-0724.html

http://rhn.redhat.com/errata/RHSA-2016-0997.html

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

http://www.securityfocus.com/bid/90316

http://support.citrix.com/article/CTX212736

http://rhn.redhat.com/errata/RHSA-2016-1943.html

Details

Risk Information

CVSS v2

CVSS v3