CVEvulnerability
CVE-2016-3710
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-05-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-119
Description
The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.
Affected configurations
• debian debian linux 8.0
• hp helion openstack 2.0.0
• hp helion openstack 2.1.0
• hp helion openstack 2.1.2
• hp helion openstack 2.1.4
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 15.10
• canonical ubuntu linux 16.04
• qemu qemu (<= 2.5.1)
• qemu qemu 2.6.0
• oracle vm server 3.2
• oracle vm server 3.3
• oracle vm server 3.4
• oracle linux 5
• oracle linux 6
• oracle linux 7
• citrix xenserver (<= 7.0)
• redhat openstack 5.0
• redhat openstack 6.0
• redhat openstack 7.0
• redhat openstack 8
• redhat virtualization 3.0
• redhat enterprise linux desktop 6.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux server 6.0
• redhat enterprise linux server 7.0
• redhat enterprise linux server aus 7.2
• redhat enterprise linux server aus 7.3
• redhat enterprise linux server aus 7.4
• redhat enterprise linux server aus 7.6
• redhat enterprise linux server eus 7.2
• redhat enterprise linux server eus 7.3
• redhat enterprise linux server eus 7.4
• redhat enterprise linux server eus 7.5
• redhat enterprise linux server eus 7.6
• redhat enterprise linux server eus 7.7
• redhat enterprise linux server tus 7.2
• redhat enterprise linux server tus 7.3
• redhat enterprise linux server tus 7.6
• redhat enterprise linux server tus 7.7
• redhat enterprise linux workstation 6.0
• redhat enterprise linux workstation 7.0
Related
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
References
- http://rhn.redhat.com/errata/RHSA-2016-0724.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0725.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0997.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0999.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1000.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1001.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1002.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1019.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1943.html Third Party Advisory
- http://support.citrix.com/article/CTX212736 Third Party Advisory
- http://www.debian.org/security/2016/dsa-3573 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/05/09/3 Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html Third Party Advisory
- http://www.securityfocus.com/bid/90316 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1035794 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2974-1 Third Party Advisory
- http://xenbits.xen.org/xsa/advisory-179.html Third Party Advisory
- https://access.redhat.com/errata/RHSA-2016:1224 Third Party Advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862 Third Party Advisory, Vendor Advisory
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg01197.html Mailing List, Patch, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0724.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0725.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0997.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0999.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1000.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1001.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1002.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1019.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-1943.html Third Party Advisory
- http://support.citrix.com/article/CTX212736 Third Party Advisory
- http://www.debian.org/security/2016/dsa-3573 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/05/09/3 Mailing List, Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html Third Party Advisory
- http://www.securityfocus.com/bid/90316 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1035794 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2974-1 Third Party Advisory
- http://xenbits.xen.org/xsa/advisory-179.html Third Party Advisory
- https://access.redhat.com/errata/RHSA-2016:1224 Third Party Advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862 Third Party Advisory, Vendor Advisory
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg01197.html Mailing List, Patch, Third Party Advisory