Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

None

Privileges Required

Low

Attack Vector

Local

0

CVE-2016-3710

Disclosure Date: May 11, 2016 •

CVE-2016-3710 CVSS v3 Base Score: 8.8

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the “Dark Portal” issue.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

8.8 High

Impact Score:

6

Exploitability Score:

2

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector (AV):

Local

Attack Complexity (AC):

Low

Privileges Required (PR):

Low

User Interaction (UI):

None

Scope (S):

Changed

Confidentiality (C):

High

Integrity (I):

High

Availability (A):

High

Vendors

canonical,
citrix,
debian,
hp,
oracle,
qemu,
redhat

Products

References

Canonical

CVE-2016-3710 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3710)

BID-90316 (http://www.securityfocus.com/bid/90316)

Advisory

http://xenbits.xen.org/xsa/advisory-179.html

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

http://rhn.redhat.com/errata/RHSA-2016-0999.html

http://rhn.redhat.com/errata/RHSA-2016-0725.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

http://rhn.redhat.com/errata/RHSA-2016-1000.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

http://support.citrix.com/article/CTX212736

http://rhn.redhat.com/errata/RHSA-2016-1002.html

http://rhn.redhat.com/errata/RHSA-2016-1001.html

http://rhn.redhat.com/errata/RHSA-2016-0997.html

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862

SECTRACK-1035794 (http://www.securitytracker.com/id/1035794)

http://rhn.redhat.com/errata/RHSA-2016-1943.html

http://rhn.redhat.com/errata/RHSA-2016-1019.html

USN-2974-1 (http://www.ubuntu.com/usn/USN-2974-1)

[oss-security] 20160509 CVE-2016-3710 Qemu: vga: out-of-bounds r/w access issue (http://www.openwall.com/lists/oss-security/2016/05/09/3)

http://rhn.redhat.com/errata/RHSA-2016-0724.html

[Qemu-devel] 20160509 [PULL 1/5] vga: fix banked access bounds checking (CVE-2016-3710) (https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg01197.html)

https://access.redhat.com/errata/RHSA-2016:1224

DSA-3573 (http://www.debian.org/security/2016/dsa-3573)

Rapid7

Technical Analysis