Vulnerability Description
The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the QEMU host via vectors involving DMA read into ESP command buffer.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Qemu | Qemu | <= 2.6.2 |
| Canonical | Ubuntu Linux | 12.04 |
| Debian | Debian Linux | 8.0 |
References
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=926cde5f3e4d2504ed161ed0cb771ac7c
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=cc96677469388bad3d66479379735cf75
- http://www.openwall.com/lists/oss-security/2016/07/25/14Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/07/26/7Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/92119Third Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/USN-3047-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-3047-2Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing ListThird Party Advisory
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=926cde5f3e4d2504ed161ed0cb771ac7c
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=cc96677469388bad3d66479379735cf75
- http://www.openwall.com/lists/oss-security/2016/07/25/14Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/07/26/7Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/92119Third Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/USN-3047-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-3047-2Third Party Advisory
FAQ
What is CVE-2016-6351?
CVE-2016-6351 is a vulnerability with a CVSS score of 6.7 (MEDIUM). The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service (out...
How severe is CVE-2016-6351?
CVE-2016-6351 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-6351?
Check the references section above for vendor advisories and patch information. Affected products include: Qemu Qemu, Canonical Ubuntu Linux, Debian Debian Linux.