CWE Code: 119
Vulnerability Type: privilege_escalation
CVSS Score: 6.9
CWE Name:  Improper Restriction of Operations within the Bounds of a Memory Buffer
Summary: the (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in qemu before 2.4, when built with the firmware configuration device emulation support, allow guest os users with the cap_sys_rawio privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2016-04-07
Last Modified Date: 2017-11-04