CVE-2015-8818

Published: 29 December 2016

The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors.

Priority

Low

CVSS 3 base score: 5.5

Status

Package Release Status
qemu
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable
(1:2.5+dfsg-5ubuntu4)
Ubuntu 14.04 ESM (Trusty Tahr) Ignored

Patches:
Upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=c3c1bb99d1c11978d9ce94d1bd
Upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=e4a511f8cc6f4a46d409fb5c9f
Upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=965eb2fcdfe919ecced6c34803
Upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=b242e0e0e2969c044a318e56f7
qemu-kvm
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 16.04 ESM (Xenial Xerus) Does not exist

Ubuntu 14.04 ESM (Trusty Tahr) Does not exist

Notes

AuthorNote
mdeslaur
1.6.0 to 2.3.1
same patches as CVE-2015-8817, see oss-security
list of commits may be incomplete, see
https://lists.gnu.org/archive/html/qemu-stable/2016-01/msg00065.html
we will not be releasing an update for this this issue.

References