Attacker Value
Unknown
CVE-2016-5126
CVE-2016-5126
(Last updated February 02, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
Quick Emulator(QEMU) built with the Block driver for iSCSI images support (virtio-blk) is vulnerable to a heap-based buffer overflow issue. The flaw could occur while processing iSCSI asynchronous I/O ioctl(2) calls. A user inside a guest could exploit this flaw to crash the QEMU process resulting in denial of service, or potentially leverage it to execute arbitrary code with QEMU-process privileges on the host.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
7.8 High
Impact Score:
5.9
Exploitability Score:
1.8
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Vendors
- Red Hat
Products
- Red Hat Enterprise Linux 7,
- Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7,
- Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7,
- Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7,
- Red Hat OpenStack Platform 8.0 (Liberty),
- Red Hat OpenStack Platform 9.0 (Mitaka),
- RHEV 3.X Hypervisor and Agents for RHEL-7
References
Advisory
Miscellaneous
