CVE-2013-2016

2019-12-3021:47:07

redhat

www.cve.org

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.3%

JSON

A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host’s qemu address space and thus increase their privileges on the host.

CNA Affected

[
  {
    "product": "qemu (virtio-rng)",
    "vendor": "qemu",
    "versions": [
      {
        "status": "affected",
        "version": "v1.3.0 and later"
      }
    ]
  }
]