CVE-2016-1568
moderate-risk
Published 2016-04-12
Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.
Do I need to act?
-
0.34% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10
High
LOCAL
/ LOW complexity
Affected Products (7)
References (26)
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0084.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0086.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0087.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0088.html
Third Party Advisory
http://www.debian.org/security/2016/dsa-3469
Third Party Advisory
http://www.debian.org/security/2016/dsa-3470
Third Party Advisory
http://www.debian.org/security/2016/dsa-3471
Third Party Advisory
http://www.securityfocus.com/bid/80191
Third Party Advisory
http://www.securitytracker.com/id/1034859
Third Party Advisory
https://security.gentoo.org/glsa/201602-01
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0084.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0086.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0087.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0088.html
Third Party Advisory
http://www.debian.org/security/2016/dsa-3469
Third Party Advisory
http://www.debian.org/security/2016/dsa-3470
and 6 more references
42
/ 100
moderate-risk
Severity
27/34 · High
Exploitability
1/34 · Minimal
Exposure
14/34 · Moderate