VulnerabilityModified

CVE-2015-3214

The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid…

MEDIUM 6.9EPSS 1.59%

Does this matter?

Lower severity and a low EPSS score (1.59%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
EPSS: 1.59% probability · 74th percentile
CISA KEV: Not listed
Weakness: CWE-119
Affected: qemu/qemu · linux/linux kernel · arista/eos · debian/debian linux · lenovo/emc px12-400r ivx · lenovo/emc px12-450r ivx · redhat/openstack · redhat/virtualization · redhat/enterprise linux compute node eus · redhat/enterprise linux for power big endian · redhat/enterprise linux for power big endian eus · redhat/enterprise linux for scientific computing · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux server eus · redhat/enterprise linux server from rhui · redhat/enterprise linux server tus · redhat/enterprise linux server update services for sap solutions · redhat/enterprise linux workstation
Source: secalert@redhat.com

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ee73f656a604d5aa9df86a97102e4e462dd79924Patch, Vendor Advisory
http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.33Broken Link, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1507.htmlIssue Tracking, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1508.htmlIssue Tracking, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1512.htmlThird Party Advisory
http://www.debian.org/security/2015/dsa-3348Issue Tracking, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/06/25/7Mailing List
http://www.securityfocus.com/bid/75273Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032598Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1229640Issue Tracking
https://github.com/torvalds/linux/commit/ee73f656a604d5aa9df86a97102e4e462dd79924Patch, Third Party Advisory
https://security.gentoo.org/glsa/201510-02Issue Tracking, Third Party Advisory
https://support.lenovo.com/product_security/qemuThird Party Advisory
https://support.lenovo.com/us/en/product_security/qemuThird Party Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/1180-security-advisory-13Third Party Advisory
https://www.exploit-db.com/exploits/37990/Third Party Advisory, VDB Entry
https://www.mail-archive.com/qemu-devel%40nongnu.org/msg304138.html
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ee73f656a604d5aa9df86a97102e4e462dd79924Patch, Vendor Advisory
http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.33Broken Link, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1507.htmlIssue Tracking, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1508.htmlIssue Tracking, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1512.htmlThird Party Advisory
http://www.debian.org/security/2015/dsa-3348Issue Tracking, Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/06/25/7Mailing List
http://www.securityfocus.com/bid/75273Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032598Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1229640Issue Tracking
https://github.com/torvalds/linux/commit/ee73f656a604d5aa9df86a97102e4e462dd79924Patch, Third Party Advisory
https://security.gentoo.org/glsa/201510-02Issue Tracking, Third Party Advisory
https://support.lenovo.com/product_security/qemuThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.