CVE-2016-4439MEDIUM
Description
The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the QEMU host via unspecified vectors.
References
http://www.openwall.com/lists/oss-security/2016/05/19/3
http://www.securityfocus.com/bid/90760
http://www.ubuntu.com/usn/USN-3047-1
http://www.ubuntu.com/usn/USN-3047-2
https://bugzilla.redhat.com/show_bug.cgi?id=1337502
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg03273.html
Details
Source: MITRE
Published: 2016-05-20
Updated: 2020-05-14
Type: CWE-119
Risk Information
CVSS v2.0
Base Score: 4.6
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 3.9
Severity: MEDIUM
CVSS v3.0
Base Score: 6.7
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 0.8
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
Configuration 2
OR
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* versions up to 2.6.0 (inclusive)
Configuration 3
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 119310 | Debian DLA-1599-1 : qemu security update | Nessus | Debian Local Security Checks | critical |
| 94608 | SUSE SLES11 Security Update : xen (SUSE-SU-2016:2725-1) (Bunker Buster) | Nessus | SuSE Local Security Checks | high |
| 94269 | SUSE SLES12 Security Update : xen (SUSE-SU-2016:2533-1) (Bunker Buster) | Nessus | SuSE Local Security Checks | high |
| 94267 | SUSE SLES11 Security Update : xen (SUSE-SU-2016:2528-1) (Bunker Buster) | Nessus | SuSE Local Security Checks | high |
| 94000 | openSUSE Security Update : xen (openSUSE-2016-1170) (Bunker Buster) | Nessus | SuSE Local Security Checks | high |
| 93999 | openSUSE Security Update : xen (openSUSE-2016-1169) (Bunker Buster) | Nessus | SuSE Local Security Checks | high |
| 93697 | GLSA-201609-01 : QEMU: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | medium |
| 93298 | SUSE SLES11 Security Update : xen (SUSE-SU-2016:2100-1) (Bunker Buster) | Nessus | SuSE Local Security Checks | high |
| 93296 | SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:2093-1) (Bunker Buster) | Nessus | SuSE Local Security Checks | high |
| 93180 | SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1785-1) | Nessus | SuSE Local Security Checks | high |
| 93170 | SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1703-1) | Nessus | SuSE Local Security Checks | high |
| 93169 | SUSE SLES11 Security Update : kvm (SUSE-SU-2016:1698-1) | Nessus | SuSE Local Security Checks | high |
| 92966 | Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS : qemu, qemu-kvm regression (USN-3047-2) | Nessus | Ubuntu Local Security Checks | high |
| 92751 | Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS : qemu, qemu-kvm vulnerabilities (USN-3047-1) | Nessus | Ubuntu Local Security Checks | high |
| 92637 | Debian DLA-573-1 : qemu security update | Nessus | Debian Local Security Checks | high |
| 92197 | Fedora 24 : 2:qemu (2016-f13ea849c5) | Nessus | Fedora Local Security Checks | medium |
| 92174 | Fedora 22 : 2:qemu (2016-d3a56228f5) | Nessus | Fedora Local Security Checks | medium |
| 92168 | Fedora 24 : xen (2016-cfea37952b) | Nessus | Fedora Local Security Checks | medium |
| 92126 | Fedora 23 : xen (2016-8d3fe9914b) | Nessus | Fedora Local Security Checks | medium |
| 92094 | Fedora 22 : xen (2016-4edd58a3b5) | Nessus | Fedora Local Security Checks | medium |
| 92056 | Fedora 23 : 2:qemu (2016-07eca37ea0) | Nessus | Fedora Local Security Checks | medium |
| 92004 | Debian DLA-574-1 : qemu-kvm security update | Nessus | Debian Local Security Checks | high |
| 91980 | openSUSE Security Update : qemu (openSUSE-2016-839) | Nessus | SuSE Local Security Checks | high |
| 91660 | SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1560-1) | Nessus | SuSE Local Security Checks | high |