Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Local
0

CVE-2016-1714

Disclosure Date: April 07, 2016
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

An out-of-bounds read/write flaw was discovered in the way QEMU’s Firmware Configuration device emulation processed certain firmware configurations. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
8.1 High
Impact Score:
6
Exploitability Score:
1.4
Vector:
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
High
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Changed
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • Red Hat

Products

  • Red Hat Enterprise Linux 6,
  • Red Hat Enterprise Linux 7,
  • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6,
  • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7,
  • Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7,
  • Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7,
  • RHEV 3.6 For IBM Power Systems,
  • RHEV 3.X Hypervisor and Agents for RHEL-6,
  • RHEV 3.X Hypervisor and Agents for RHEL-7

References

Additional Info

Technical Analysis