CVE-2016-6351

Description

The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the QEMU host via vectors involving DMA read into ESP command buffer.

6.7

CVSS

Severity: Medium

CVSS 3.1 •

CVSS 2.0 •

EPSS 0.24%

Vendor Advisory ubuntu.com Vendor Advisory ubuntu.com

Affected: n/a n/a

References

Link	Tags
http://www.ubuntu.com/usn/USN-3047-1	third party advisory vendor advisory
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=cc96677469388bad3d66479379735cf75db069e3
http://www.ubuntu.com/usn/USN-3047-2	third party advisory vendor advisory
http://www.openwall.com/lists/oss-security/2016/07/25/14	third party advisory mailing list
http://www.openwall.com/lists/oss-security/2016/07/26/7	third party advisory mailing list
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=926cde5f3e4d2504ed161ed0cb771ac7cad6fd11
http://www.securityfocus.com/bid/92119	third party advisory vdb entry
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html	third party advisory mailing list

Frequently Asked Questions

What is the severity of CVE-2016-6351?: CVE-2016-6351 has been scored as a medium severity vulnerability.
How to fix CVE-2016-6351?: To fix CVE-2016-6351, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2016-6351 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2016-6351 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.