CVE-2016-5126 — Out-of-bounds Write in Qemu

CWE-787 — Out-of-bounds WriteCWE-120 — Classic Buffer Overflow9 documents8 sources
Severity
7.8HIGHNVD
EPSS
0.3%
top 50.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
12
QemuCanonical Ubuntu LinuxDebian Linux+9 more
Timeline
PublishedJun 1
Latest updateMay 13

Description

Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages8 packages

▶Debianqemu/qemu< 1:2.6+dfsg-2+3
▶NVDqemu/qemu2.6.2
▶NVDredhat/openstack5 versions+4

Also affects: Debian Linux 8.0, Ubuntu Linux 12.04, 14.04, 16.04, Enterprise Linux 7.2, 7.3, 7.4, 7.5, 7.6, 7.7

Patches

Patch: lists.gnu.org ↗Patch: lists.gnu.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-qgv9-9qpm-r86f: Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi↗2022-05-13
▶
OSV
CVE-2016-5126: Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi↗2016-06-01
▶
CVEList
CVE-2016-5126: Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi↗2016-06-01
▶

📋Vendor Advisories

3
Ubuntu
QEMU vulnerabilities↗2016-08-04
▶
Red Hat
Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl↗2016-05-24
▶
Debian
CVE-2016-5126: qemu - Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in Q...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-5126 Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl↗2016-05-30
▶
Bugzilla
CVE-2016-5126 Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl [fedora-all]↗2016-05-30
▶
CVE-2016-5126 — Out-of-bounds Write in Qemu | cvebase