Explain CVE-2016-1714
The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.
Affected Products: n/a
References: [{'name': '[oss-security] 20160112 Re: CVE request Qemu: nvram: OOB r/w access in processing firmware configurations', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/01/12/10'}, {'name': 'RHSA-2016:0083', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0083.html'}, {'name': 'RHSA-2016:0085', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0085.html'}, {'name': 'RHSA-2016:0086', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0086.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html'}, {'name': '[oss-security] 20160112 Re: Re: CVE request Qemu: nvram: OOB r/w access in processing firmware configurations', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/01/12/11'}, {'name': '[oss-security] 20160111 CVE request Qemu: nvram: OOB r/w access in processing firmware configurations', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/01/11/7'}, {'name': '1034858', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1034858'}, {'name': '[Qemu-devel] 20160106 [PATCH v2 for v2.3.0] fw_cfg: add check to validate current entry value', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg00428.html'}, {'name': 'RHSA-2016:0081', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0081.html'}, {'name': '80250', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/80250'}, {'name': 'GLSA-201604-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201604-01'}, {'name': 'DSA-3469', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3469'}, {'name': 'DSA-3470', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3470'}, {'name': 'RHSA-2016:0082', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0082.html'}, {'name': 'RHSA-2016:0087', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0087.html'}, {'name': 'RHSA-2016:0084', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0084.html'}, {'name': 'DSA-3471', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3471'}, {'name': 'RHSA-2016:0088', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0088.html'}]
CVE State: PUBLISHED