CVE-2016-1568
Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ)…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.53%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 0.53% probability · 43th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-416
- Affected
- qemu/qemu · redhat/openstack · redhat/virtualization · debian/debian linux
- Source
- secalert@redhat.com
References
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ab0359a8ae182a7ac5c99609667273167703fab
- http://rhn.redhat.com/errata/RHSA-2016-0084.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0086.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0087.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0088.htmlThird Party Advisory
- http://www.debian.org/security/2016/dsa-3469Third Party Advisory
- http://www.debian.org/security/2016/dsa-3470Third Party Advisory
- http://www.debian.org/security/2016/dsa-3471Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/01/09/1Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/01/09/2Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/80191Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1034859Third Party Advisory, VDB Entry
- https://security.gentoo.org/glsa/201602-01Third Party Advisory
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ab0359a8ae182a7ac5c99609667273167703fab
- http://rhn.redhat.com/errata/RHSA-2016-0084.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0086.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0087.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0088.htmlThird Party Advisory
- http://www.debian.org/security/2016/dsa-3469Third Party Advisory
- http://www.debian.org/security/2016/dsa-3470Third Party Advisory
- http://www.debian.org/security/2016/dsa-3471Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/01/09/1Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2016/01/09/2Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/80191Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1034859Third Party Advisory, VDB Entry
- https://security.gentoo.org/glsa/201602-01Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.