NVD

Id
18063  
Name
CVE-2016-1714  
Description
The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2016-04-07  
Modified Date
2016-12-02  
Seq
2016-1714  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
99478 18063 CVE-2016-1714 RHSA-2016:0081  View
99479 18063 CVE-2016-1714 RHSA-2016:0082  View
99480 18063 CVE-2016-1714 RHSA-2016:0083  View
99481 18063 CVE-2016-1714 RHSA-2016:0084  View
99482 18063 CVE-2016-1714 RHSA-2016:0085  View
99483 18063 CVE-2016-1714 RHSA-2016:0086  View
99484 18063 CVE-2016-1714 RHSA-2016:0087  View
99485 18063 CVE-2016-1714 RHSA-2016:0088  View
99486 18063 CVE-2016-1714 [oss-security] 20160111 CVE request Qemu: nvram: OOB r/w access in processing firmware configurations  View
99487 18063 CVE-2016-1714 [oss-security] 20160112 Re: CVE request Qemu: nvram: OOB r/w access in processing firmware configurations  View
99488 18063 CVE-2016-1714 [oss-security] 20160112 Re: Re: CVE request Qemu: nvram: OOB r/w access in processing firmware configurations  View
99489 18063 CVE-2016-1714 http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html  View
99490 18063 CVE-2016-1714 80250  View
99491 18063 CVE-2016-1714 1034858  View
99492 18063 CVE-2016-1714 [Qemu-devel] 20160106 [PATCH v2 for v2.3.0] fw_cfg: add check to validate current entry value  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
1209 JVNDB-2016-001982 QEMU の hw/nvram/fw_cfg.c の fw_cfg_write および fw_cfg_read 関数におけるサービス運用妨害 (DoS) の脆弱性 QEMU の hw/nvram/fw_cfg.c の (1) fw_cfg_write および (2) fw_cfg_read 関数は、ファームウェア設定デバイスのエミュレーションサポートでビルドされている場合、サービス運用妨害 (境界外読み取りまたは書き込みアクセスおよびプロセスクラッシュ) 状態にされる、または任意のコードを実行される脆弱性が存在します。 CVE-2016-1714 88220 CVE-2016-1714 18063 6.9 8.1 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-001982.html 2016-01-06 2016-11-22 View