Qemu vga module Arbitrary Code Execution Vulnerability (CVE-2016-3710)

Qemu vga module Arbitrary Code Execution Vulnerability (CVE-2016-3710)
Qemu vga module Arbitrary Code Execution Vulnerability (CVE-2016-3710)

Release date:
Updated on:

Affected Systems:

QEMU

Description:

CVE (CAN) ID: CVE-2016-3710

QEMU is an open source simulator software.

The qemu vga module has a memory access mode vulnerability. Local privileged users can exploit this vulnerability to execute arbitrary code within the Qemu process permission.

<* Source: Qinghao Tang
Wei Xiao

Zuozhi Fzz
*>

Suggestion:

Vendor patch:

QEMU
----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://fabrice.bellard.free.fr/qemu/

Http://xenbits.xen.org/xsa/advisory-179.html

Http://www.debian.org/security/2016/dsa-3573

Http://www.securitytracker.com/id/1035794

Use KVM + Qemu to build a virtual machine in Ubuntu

Linux getting started Tutorial: QEMU for Virtual Machine experience

Ubuntu 12.04 cannot find the Qemu command

Install QEMU + efi bios on Arch Linux

QEMU translation framework and debugging tools

QEMU code analysis: BIOS loading process

QEMU details: click here
QEMU: click here

This article permanently updates the link address: