ISOMAN

CVE

CVE-2016-4020

The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).

Severity
MEDIUM
CVSS
6.5
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource

References

  1. http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=691a02e2ce0c413236a78dee6f2651c937b09fb0
  2. http://www.securityfocus.com/bid/86067
  3. http://www.ubuntu.com/usn/USN-2974-1
  4. https://access.redhat.com/errata/RHSA-2017:1856
  5. https://access.redhat.com/errata/RHSA-2017:2392
  6. https://access.redhat.com/errata/RHSA-2017:2408
  7. https://bugzilla.redhat.com/show_bug.cgi?id=1313686
  8. https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
  9. https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01106.html
  10. https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01118.html
  11. https://security.gentoo.org/glsa/201609-01
  12. http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=691a02e2ce0c413236a78dee6f2651c937b09fb0
  13. http://www.securityfocus.com/bid/86067
  14. http://www.ubuntu.com/usn/USN-2974-1
  15. https://access.redhat.com/errata/RHSA-2017:1856
  16. https://access.redhat.com/errata/RHSA-2017:2392
  17. https://access.redhat.com/errata/RHSA-2017:2408
  18. https://bugzilla.redhat.com/show_bug.cgi?id=1313686
  19. https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
  20. https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01106.html