CVE-2016-4020
medium
CVSS v3
6.5
CVSS v2
2.1
VIR risk
6.5
Description
The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).
Predictions
Exploit likelihood
65%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2016-4020
Vendor advisory: secalert@redhat.com — https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01118.html
Vendor advisory: secalert@redhat.com — https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01106.html
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2016-4020.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| rhel | 7.0 | affected | |
| rhel | 7.4 | affected | |
| rhel | 7.5 | affected | |
| rhel | 7.6 | affected | |
| rhel | 7.7 | affected | |
| ubuntu | 12.04 | affected | |
| ubuntu | 14.04 | affected | |
| ubuntu | 15.10 | affected | |
| ubuntu | 16.04 | affected | |
| debian | 8.0 | affected | |
| debian | bookworm | fixed | 1:2.6+dfsg-2 |
| debian | bullseye | fixed | 1:2.6+dfsg-2 |
| debian | forky | fixed | 1:2.6+dfsg-2 |
| debian | sid | fixed | 1:2.6+dfsg-2 |
| debian | trixie | fixed | 1:2.6+dfsg-2 |
References
- https://www.suse.com/security/cve/CVE-2016-4020.html
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=691a02e2ce0c413236a78dee6f2651c937b09fb0
- http://www.securityfocus.com/bid/86067
- http://www.ubuntu.com/usn/USN-2974-1
- https://access.redhat.com/errata/RHSA-2017:1856
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1313686
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01106.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01118.html
- https://security.gentoo.org/glsa/201609-01
- https://security-tracker.debian.org/tracker/CVE-2016-4020
Verify integrity in audit chain (admin only). AS-IS.