CVE-2016-7170
published 2016-12-10CVE-2016-7170: The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service…
PriorityP415medium4.4CVSS 3.1
AVLACLPRHUINSUCNINAH
EPSS
0.40%
32.9th percentile
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | qemu | < qemu 1:2.8+dfsg-1 (bookworm) | qemu 1:2.8+dfsg-1 (bookworm) |
| opensuse | leap | — | — |
| qemu | qemu | <= 2.7.1 | — |
| qemu | qemu | >= 0 < 1:2.8+dfsg-1 | 1:2.8+dfsg-1 |
| qemu | qemu | >= 0 < 1:2.8+dfsg-1 | 1:2.8+dfsg-1 |
| qemu | qemu | >= 0 < 1:2.8+dfsg-1 | 1:2.8+dfsg-1 |
| qemu | qemu | >= 0 < 1:2.8+dfsg-1 | 1:2.8+dfsg-1 |
| qemu | qemu | >= 0 < 2.0.0+dfsg-2ubuntu1.30 | 2.0.0+dfsg-2ubuntu1.30 |
| qemu | qemu | >= 0 < 1:2.5+dfsg-5ubuntu10.6 | 1:2.5+dfsg-5ubuntu10.6 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_ubuntu5.5MEDIUM
vendor_debian4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-g884-2vqj-jrfw: The vmsvga_fifo_run function in hw/display/vmware_vga
ghsa_unreviewed·2022-05-13
CVE-2016-7170 [MEDIUM] CWE-129 GHSA-g884-2vqj-jrfw: The vmsvga_fifo_run function in hw/display/vmware_vga
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command.
OSV
CVE-2016-7170: The vmsvga_fifo_run function in hw/display/vmware_vga
osv·2016-12-10·CVSS 4.4
CVE-2016-7170 [MEDIUM] CVE-2016-7170: The vmsvga_fifo_run function in hw/display/vmware_vga
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command.
OSV
qemu, qemu-kvm vulnerabilities
osv·2016-11-09·CVSS 5.5
CVE-2016-5403 [MEDIUM] qemu, qemu-kvm vulnerabilities
qemu, qemu-kvm vulnerabilities
Zhenhao Hong discovered that QEMU incorrectly handled the Virtio module. A
privileged attacker inside the guest could use this issue to cause QEMU to
consume resources, resulting in a denial of service. (CVE-2016-5403)
Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network
card emulation support. A privileged attacker inside the guest could use
this issue to cause QEMU to crash, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10.
(CVE-2016-6833, CVE-2016-6834, CVE-2016-6888)
Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network
card emulation support. A privileged attacker inside the guest could use
this issue to cause QEMU to crash, resulting in a denial of se
Red Hat
ntp: Ephemeral association time spoofing additional protection
vendor_redhat·2018-02-27·CVSS 6.5
CVE-2018-7170 [MEDIUM] ntp: Ephemeral association time spoofing additional protection
ntp: Ephemeral association time spoofing additional protection
ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.
A flaw was found in ntpd making it vulnerable to Sybil attacks. An authenticated attacker could target systems configured to use a trusted key in certain configurations and to create an arbitrary number of associations and subsequently modify a victim's clock.
Package: ntp (Red Hat Enterprise Linux 5) - Will not fix
Package: ntp (Red Hat Enterprise Linux 6) - Will not fix
Package: ntp (Red Hat Enterpr
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2016-11-09·CVSS 5.5
CVE-2016-5403 [MEDIUM] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
Zhenhao Hong discovered that QEMU incorrectly handled the Virtio module. A
privileged attacker inside the guest could use this issue to cause QEMU to
consume resources, resulting in a denial of service. (CVE-2016-5403)
Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network
card emulation support. A privileged attacker inside the guest could use
this issue to cause QEMU to crash, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10.
(CVE-2016-6833, CVE-2016-6834, CVE-2016-6888)
Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network
card emulation support. A privileged attacker inside the guest could use
this issue
Red Hat
Qemu: vmware_vga: OOB stack memory access when processing svga command
vendor_redhat·2016-09-08·CVSS 4.4
CVE-2016-7170 [MEDIUM] CWE-121 Qemu: vmware_vga: OOB stack memory access when processing svga command
Qemu: vmware_vga: OOB stack memory access when processing svga command
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command.
Quick Emulator (QEMU) built with the VMware-SVGA chipset emulation support is vulnerable to an OOB stack memory write issue. It could occur while processing VGA commands in 'vmsvga_fifo_run' routine. A privileged user inside guest could use this flaw to crash the QEMU process resulting in DoS.
Package: kvm (Red Hat Enterprise Linux 5) - Will not fix
Package: xen (Red Hat Enterprise Linux 5) - Not affected
Packa
Debian
CVE-2016-7170: qemu - The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emula...
vendor_debian·2016·CVSS 4.4
CVE-2016-7170 [MEDIUM] CVE-2016-7170: qemu - The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emula...
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command.
Scope: local
bookworm: resolved (fixed in 1:2.8+dfsg-1)
bullseye: resolved (fixed in 1:2.8+dfsg-1)
forky: resolved (fixed in 1:2.8+dfsg-1)
sid: resolved (fixed in 1:2.8+dfsg-1)
trixie: resolved (fixed in 1:2.8+dfsg-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-7170 ntp: Ephemeral association time spoofing additional protection
bugzilla·2018-02-28·CVSS 6.5
CVE-2018-7170 [MEDIUM] CVE-2018-7170 ntp: Ephemeral association time spoofing additional protection
CVE-2018-7170 ntp: Ephemeral association time spoofing additional protection
ntpd can be vulnerable to Sybil attacks. If a system is set up to use a trustedkey and if one is not using the feature introduced in ntp-4.2.8p6 allowing an optional 4th field in the ntp.keys file to specify which IPs can serve time, a malicious authenticated peer -- i.e. one where the attacker knows the private symmetric key -- can create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock.
Ps.: This is possibly a incomplete fix for CVE-2016-1549.
References:
http://support.ntp.org/bin/view/Main/NtpBug3415
Discussion:
Created ntp tracking bugs for this issue:
Affects: fedora-all [bug 1550228]
Bugzilla
CVE-2016-7170 Qemu: vmware_vga: OOB stack memory access when processing svga command
bugzilla·2016-09-09·CVSS 4.4
CVE-2016-7170 [MEDIUM] CVE-2016-7170 Qemu: vmware_vga: OOB stack memory access when processing svga command
CVE-2016-7170 Qemu: vmware_vga: OOB stack memory access when processing svga command
Quick Emulator(Qemu) built with the VMware-SVGA "chipset" emulation support
is vulnerable to an OOB stack memory write issue. It could occur while
processing VGA commands in 'vmsvga_fifo_run' routine.
A privileged user inside guest could use this flaw to crash the Qemu process
resulting in DoS.
Upstream fix:
-> git.qemu.org/?p=qemu.git;a=commit;h=167d97a3def77ee2dbf6e908b0ecbfe2103977db
Reference:
-> http://www.openwall.com/lists/oss-security/2016/09/09/7
Discussion:
Acknowledgments:
Name: Qinghao Tang, Li Qiang (360.cn Inc.)
---
Created qemu tracking bugs for this issue:
Affects: fedora-all [bug 1374709]
---
*** Bug 1329193 has been marked as a duplicate of this bug. ***
Bugzilla
CVE-2016-7170 Qemu: vmware_vga: OOB stack memory access when processing svga command [fedora-all]
bugzilla·2016-09-09·CVSS 4.4
CVE-2016-7170 [MEDIUM] CVE-2016-7170 Qemu: vmware_vga: OOB stack memory access when processing svga command [fedora-all]
CVE-2016-7170 Qemu: vmware_vga: OOB stack memory access when processing svga command [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple su
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=167d97a3def77ee2dbf6e908b0ecbfe2103977dbhttp://lists.opensuse.org/opensuse-updates/2016-12/msg00140.htmlhttp://www.openwall.com/lists/oss-security/2016/09/09/4http://www.openwall.com/lists/oss-security/2016/09/09/7http://www.securityfocus.com/bid/92904https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlhttps://lists.gnu.org/archive/html/qemu-devel/2016-09/msg01764.htmlhttp://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=167d97a3def77ee2dbf6e908b0ecbfe2103977dbhttp://lists.opensuse.org/opensuse-updates/2016-12/msg00140.htmlhttp://www.openwall.com/lists/oss-security/2016/09/09/4http://www.openwall.com/lists/oss-security/2016/09/09/7http://www.securityfocus.com/bid/92904https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlhttps://lists.gnu.org/archive/html/qemu-devel/2016-09/msg01764.html
2016-12-10
Published