The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized variable, which allows local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface (MFI) command.
http://www.openwall.com/lists/oss-security/2016/05/25/5
http://www.openwall.com/lists/oss-security/2016/05/26/7
http://www.ubuntu.com/usn/USN-3047-1
http://www.ubuntu.com/usn/USN-3047-2
https://bugzilla.redhat.com/show_bug.cgi?id=1339583
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04419.html
Source: MITRE
Published: 2016-09-02
Updated: 2020-10-21
Type: CWE-908
Base Score: 1.9
Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N
Impact Score: 2.9
Exploitability Score: 3.4
Severity: LOW
Base Score: 4.4
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Impact Score: 3.6
Exploitability Score: 0.8
Severity: MEDIUM
OR
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* versions up to 2.6.2 (inclusive)
OR
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
OR
ID | Name | Product | Family | Severity |
---|---|---|---|---|
119310 | Debian DLA-1599-1 : qemu security update | Nessus | Debian Local Security Checks | critical |
94758 | SUSE SLES12 Security Update : qemu (SUSE-SU-2016:2781-1) | Nessus | SuSE Local Security Checks | medium |
94309 | openSUSE Security Update : qemu (openSUSE-2016-1234) | Nessus | SuSE Local Security Checks | medium |
94283 | SUSE SLES11 Security Update : kvm (SUSE-SU-2016:2628-1) | Nessus | SuSE Local Security Checks | medium |
94277 | SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:2589-1) | Nessus | SuSE Local Security Checks | medium |
94269 | SUSE SLES12 Security Update : xen (SUSE-SU-2016:2533-1) (Bunker Buster) | Nessus | SuSE Local Security Checks | high |
94000 | openSUSE Security Update : xen (openSUSE-2016-1170) (Bunker Buster) | Nessus | SuSE Local Security Checks | high |
93999 | openSUSE Security Update : xen (openSUSE-2016-1169) (Bunker Buster) | Nessus | SuSE Local Security Checks | high |
93298 | SUSE SLES11 Security Update : xen (SUSE-SU-2016:2100-1) (Bunker Buster) | Nessus | SuSE Local Security Checks | high |
93296 | SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2016:2093-1) (Bunker Buster) | Nessus | SuSE Local Security Checks | high |
92966 | Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS : qemu, qemu-kvm regression (USN-3047-2) | Nessus | Ubuntu Local Security Checks | high |
92751 | Ubuntu 12.04 LTS / 14.04 LTS / 16.04 LTS : qemu, qemu-kvm vulnerabilities (USN-3047-1) | Nessus | Ubuntu Local Security Checks | high |
92299 | Fedora 22 : 2:qemu (2016-ea3002b577) | Nessus | Fedora Local Security Checks | medium |
92277 | Fedora 24 : 2:qemu (2016-a80eab65ba) | Nessus | Fedora Local Security Checks | medium |
92255 | Fedora 23 : 2:qemu (2016-73853a7a16) | Nessus | Fedora Local Security Checks | medium |
92168 | Fedora 24 : xen (2016-cfea37952b) | Nessus | Fedora Local Security Checks | medium |
92126 | Fedora 23 : xen (2016-8d3fe9914b) | Nessus | Fedora Local Security Checks | medium |
92094 | Fedora 22 : xen (2016-4edd58a3b5) | Nessus | Fedora Local Security Checks | medium |