Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2016-6351

Published: 27 July 2016

The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the QEMU host via vectors involving DMA read into ESP command buffer.

Notes

AuthorNote
mdeslaur
qemu-kvm in precise doesn't build esp.c on Ubuntu

Priority

Medium

Cvss 3 Severity Score

6.7

Score breakdown

Status

Package Release Status
qemu
Launchpad, Ubuntu, Debian
precise Does not exist

trusty
Released (2.0.0+dfsg-2ubuntu1.26)
upstream Needs triage

wily Ignored
(end of life)
xenial
Released (1:2.5+dfsg-5ubuntu10.3)
Patches:
upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=926cde5f3e4d2504ed161ed0cb771ac7cad6fd11
upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=cc96677469388bad3d66479379735cf75db069e3
qemu-kvm
Launchpad, Ubuntu, Debian
precise Not vulnerable

trusty Does not exist

upstream Needs triage

wily Does not exist

xenial Does not exist

Severity score breakdown

Parameter Value
Base score 6.7
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H